+ Post New Thread
Results 1 to 15 of 15
Windows Thread, Software Restriction Policies in Technical; I've set a software restriction policy up and I'm testing it out at present. By default I've banned all exes ...
  1. #1
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Software Restriction Policies

    I've set a software restriction policy up and I'm testing it out at present. By default I've banned all exes then setup the allowed list. The following shows the settings I have changed, the rest of the settings haven't been changed.
    Attached Images Attached Images

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Software Restriction Policies

    Very nice, now call me stupid, but you didn't actually ask a question?

  3. #3
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Patience Geoff lol I was just trying to post the rest of the pics and the site has slowed to a snails pace!

    Wes

  4. #4
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Here are the rest of the pics:
    Attached Images Attached Images

  5. #5
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Right the question is:

    I can't actually run any of the software whatsoever everytime I click on a shortcut it bring up the error cannot run due to software restrictions?

    Wes

  6. #6

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Software Restriction Policies

    Where is the GPO linked in?

  7. #7
    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,233
    Thank Post
    50
    Thanked 271 Times in 209 Posts
    Blog Entries
    6
    Rep Power
    108

    Re: Software Restriction Policies

    You need to add the location of your shortcuts to the allowed list. I'd add %allusersprofile% for simplicity.

  8. #8
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Top level of the students OU as the third priority GPO

    Wes

  9. #9
    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,233
    Thank Post
    50
    Thanked 271 Times in 209 Posts
    Blog Entries
    6
    Rep Power
    108

    Re: Software Restriction Policies

    If it's any help, I've attached the SRP we use
    Attached Files Attached Files

  10. #10
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Thanks Guys it's now working the way I want it to!


    Wes

  11. #11

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Software Restriction Policies

    Norphy thanks for that, I was having the same problems as wesleyw

    Also, the way you have done it seems a lot simpler, just allow everything from the file server.
    I was just going to go through every single exe and create a hash rule, which is why Ive put this off for so long

    And suely I can allow everything from Program files as well, instead of creating a hash rule for each app? Because if the students cant execute anything, they cant install anything

    Only problem Im having is that vb scripts wont run on logon or logoff, despite me putting, like you have, \\mydomain\netlogon\*.vbs

  12. #12
    wesleyw's Avatar
    Join Date
    Dec 2005
    Location
    Kingswinford
    Posts
    2,205
    Thank Post
    223
    Thanked 50 Times in 44 Posts
    Blog Entries
    1
    Rep Power
    30

    Re: Software Restriction Policies

    Yuu shouldn't even need the *.vbs for that it should just allow any exe file from that location?

    Wes

  13. #13
    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,233
    Thank Post
    50
    Thanked 271 Times in 209 Posts
    Blog Entries
    6
    Rep Power
    108

    Re: Software Restriction Policies

    Quote Originally Posted by sidewinder
    And suely I can allow everything from Program files as well, instead of creating a hash rule for each app? Because if the students cant execute anything, they cant install anything
    Indeed, yes. The hash rules I have in place are deny rules restricting things like games, command lines and other dodgy apps. Putting in
    Code:
    %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
    as an unrestricted rule allows everything in Program Files to be run, that is a default rule.

    Quote Originally Posted by sidewinder
    Only problem Im having is that vb scripts wont run on logon or logoff, despite me putting, like you have, \\mydomain\netlogon\*.vbs
    Yeah, that didn't work for me either, I just didn't get around to taking it out ops: It was the %userdnsdomain%\netlogon rule which let the logon/off scripts run.

  14. #14

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Software Restriction Policies

    Thanks, thats worked now

    Although %userdnsdomain% didnt work for me, I had to use the actual paths for the sysvol and netlogon shares

  15. #15

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Software Restriction Policies

    Try %LOGONSERVER%\netlogon

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 172
    Last Post: 13th June 2013, 01:02 PM
  2. Software Restriction Policies - Allow ONLY certain software
    By link470 in forum Wireless Networks
    Replies: 28
    Last Post: 9th July 2010, 04:29 PM
  3. Help write a guide for Software restriction policies for USB
    By ChrisH in forum How do you do....it?
    Replies: 7
    Last Post: 28th January 2010, 09:40 AM
  4. Replies: 11
    Last Post: 20th April 2007, 06:38 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •