+ Post New Thread
Results 1 to 8 of 8
Windows Server 2000/2003 Thread, Software Restriction policy in Technical; Hi all, I have been messing with software restriction policies on a virtual network and so far i like what ...
  1. #1

    Join Date
    May 2007
    Location
    Hull, UK
    Posts
    256
    Thank Post
    6
    Thanked 13 Times in 13 Posts
    Rep Power
    17

    Software Restriction policy

    Hi all,

    I have been messing with software restriction policies on a virtual network and so far i like what i see, could come in very handy

    But i have found a few niggles that i cant get my head around. The default policy allows all EXEs to run from %systemroot%\System32 which is where mspaint.exe is stored (for example) now the default setting i have choose is block all except DLLs. If i run Paint from the stat menu its blocked, but if i run it from the system32 folder itself it is allowed to run. Any ideas why?

    This isnt such a major problem as kids dont have access to these folders anyway but i want to understand why its allowing it.

    Cheers

    Mike

  2. #2

    nephilim's Avatar
    Join Date
    Nov 2008
    Location
    Dunstable
    Posts
    11,760
    Thank Post
    1,623
    Thanked 1,877 Times in 1,395 Posts
    Blog Entries
    2
    Rep Power
    422
    Have you tried running multiple rules to bypass this situation.

  3. #3
    Quackers's Avatar
    Join Date
    Jan 2006
    Posts
    1,310
    Thank Post
    40
    Thanked 141 Times in 116 Posts
    Rep Power
    53
    is this in case they draw a stick man, then using RM Connect 2.4 change the servers wallpaper using the "replicator" account ? with password as replicator1 ?
    Last edited by Quackers; 1st February 2009 at 12:45 AM.

  4. #4

    maniac's Avatar
    Join Date
    Feb 2007
    Location
    Kent
    Posts
    3,037
    Thank Post
    209
    Thanked 425 Times in 306 Posts
    Rep Power
    144
    What might be stopping it running from the start menu is the shortcut itself, as the exention .lnk is counted as an executable. I believe shortcuts in the userprofile are allowed by default, but I'm not sure about the 'all users' profile which is where the shortcut is stored for paint by default, so it could be that the shortcuts in the all users profile are blocked.

    Try creating a new shortcut to paint as a user, and I think you'll find it will run if the shortcut is in a location that allows executables.

    Mike.

  5. #5
    KarlGoddard's Avatar
    Join Date
    Jul 2005
    Location
    Bolton, Lancashire
    Posts
    272
    Thank Post
    37
    Thanked 18 Times in 18 Posts
    Rep Power
    25
    Quote Originally Posted by maniac View Post
    What might be stopping it running from the start menu is the shortcut itself, as the exention .lnk is counted as an executable. I believe shortcuts in the userprofile are allowed by default, but I'm not sure about the 'all users' profile which is where the shortcut is stored for paint by default, so it could be that the shortcuts in the all users profile are blocked.

    Try creating a new shortcut to paint as a user, and I think you'll find it will run if the shortcut is in a location that allows executables.

    Mike.
    yep .lnk's are probably the issue.

    I know we've had issues with pupils opening docs from the documents menu... when opened that way the get a software restriction error. when opened from within the app; File > Open they work fine

  6. #6

    Join Date
    May 2007
    Location
    Hull, UK
    Posts
    256
    Thank Post
    6
    Thanked 13 Times in 13 Posts
    Rep Power
    17
    Thanks guys will check this when i get my laptop back, left it at the GF house last night! hope she doesnt crack my password lol

  7. #7

    Join Date
    May 2007
    Location
    Hull, UK
    Posts
    256
    Thank Post
    6
    Thanked 13 Times in 13 Posts
    Rep Power
    17
    Hi guys,

    I dont think the all users profile is my problem as i redirect the kids start menus to "\\<servername\menu$\<room name>\Start Menu\"

    I have even added the specific start menu folder to the unrestricted rules list and still they cannot run anything.

    If i put \\<servername>\sharedapps$\*.* will that replicate down to all the other sub folders? or do i need to add each folder in ?

  8. #8
    rosswilson's Avatar
    Join Date
    Feb 2008
    Location
    Cheshire
    Posts
    47
    Thank Post
    15
    Thanked 10 Times in 10 Posts
    Rep Power
    15

    Solution: Uncheck .lnk files

    I know this thread is a little old, but just for anybody else who is experiencing this problem; this is what worked for me:

    Remove the ".lnk" file type from the list of filtered extensions. I have found a screenshot that shows where this can be done. Please find it attached.
    Attached Images Attached Images

SHARE:
+ Post New Thread

Similar Threads

  1. Group Policy Software Restriction
    By jj99 in forum Windows
    Replies: 5
    Last Post: 26th June 2008, 08:00 PM
  2. Software restriction policy, half working?
    By FN-GM in forum Windows
    Replies: 13
    Last Post: 10th December 2007, 12:22 PM
  3. Software Restriction Policy
    By cookie_monster in forum Windows
    Replies: 2
    Last Post: 27th November 2007, 12:54 PM
  4. CC3 Software Restriction Policy
    By cookie_monster in forum Network and Classroom Management
    Replies: 8
    Last Post: 12th June 2007, 10:28 AM
  5. GPo - Software Restriction Policy
    By Gatt in forum Wireless Networks
    Replies: 26
    Last Post: 23rd January 2006, 01:53 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •