Software restriction policy, half working?

[FN-GM]

Hi

 

A few days ago we made a software restriction policy in a separate OU and the policy we applied on that OU was a restriction so the user cannot use outlook. So basically we drag the people who have been banned into that OU and then the e-mail program is blocked. Sounds simple enough?

 

Well it works on some machine but not on others! Its weird depending on were you logon it may or may not work. Does anyone have any ideas why?

 

Z

[pallen]

Have you got loopback on some machines? Could be overiding your restriction policy.

[bossman]

Have you checked the GPOs above that OU maybe there is one which is filtering down from above.

[FN-GM]

@pallen how do you mean please?

 

@bossman we have a test user when we log into the library there is no restriction but when we log into one of the ICT rooms with the same account it works.

 

Z

[sahmeepee]

i would drop a copy of rsop.msc into the all users' start menu and run it to see what policies they're getting.

[pallen]

Have you got your clients in seperate OUs? You can enable loopback on the computer settings so that you can specify user policies based on Computer names.

 

To set user configuration per computer, follow these steps:

1. In the Group Policy Microsoft Management Console (MMC), click Computer Configuration.

2. Locate Administrative Templates, click System, click Group Policy, and then enable the Loopback Policy option.

 

You might want to check to see if there are some settings which are overriding your restriction policies on the groups of computers where the restrictions aren't being applied.

[FN-GM]

@ pallen

The thing is we don't want it per computer we want it so what ever computer they logon to it will take effect.

[FN-GM]

Bump

[pallen]

Thats what I meant, is there an existing policy in place in the computer OU which is overriding the policy you are setting. By the sounds of it there isn't any policy based on computers so thats my suggestion out. :?

 

On another thought, are they all the same version of outlook inc patches?

[sahmeepee]

Did you try running rsop.msc on the affected PC?

[Lithium]

Can't you leave users in the same OU, but simply use the restriction of the policy to only apply to a group rather than Authenticated Users?

 

I think having Loopbacks caused me some issues once, I was really lazy once and applied it to the top level of the domain... *coughs* (I'm not 100% sure why loopback is turned on at the moment...)

 

GP Results sounds like a superplan, it'll tell you if the policy is denied amongst other things - which policy wins setting stuff etc. really useful

[FN-GM]

On another thought, are they all the same version of outlook inc patches

 

Spot on

 

I had another go today and that what the problem was. I have gone round the images adding the slightly different versions I could find I have 4 Outlook2003 and 1 Outlook 2007 on the list.

 

Is there a way to make is so it will block all Outlook 2003 versions? I doubt it though.

 

Thank you!

 

Z

[pallen]

How are you applying the block? If your using the hash rule for the exe file, I think it is different for every version. Could you try blocking the path where it is run from? So you could block access to all the files in the outlook folder.

[FN-GM]

Yes we use a hash rule and you need a new one for each version