GPO Software Restriction Policies

[ITGURU]

Hello

I've recently enabled software restriction policies within my student GPO, disallowing .exe files to be run within the %userprofile% or %homepath% 'path' rules.

For the majority this works, however I get the off user who cannot use the IE icon the taskbar, or from the desktop to launch Internet Explorer.

 

It simply comes up with 'GPO has blocked this application'. The same user can log on to another PC and it works absolutely fine, so think it's machine specific.

I've tried reinstalling IE but to no avail.

 

The weird thing is that if you go to C:\Program Files or Program files (x86)\internet explorer\ and run iexplore.exe from there it works fine, no problem.

Also if the students have a website shortcut on their desktop that's works too.

 

it just wont let them launch IE from the proper icon.

 

Anyone else had this issue before, or know of a solution?

[MordyT]

Still running XP? You will need to allow .lnk files as well

[ITGURU]

Nope, all clients are Windows 7 x64.

[Arthur]

it just won't let them launch IE from the proper icon.

Does unpinning and repinning the Internet Explorer shortcut to the taskbar make any difference?

 

Are the students using mandatory or roaming profiles?

[ITGURU]

Tried that - didn't make any difference.

Students are using roaming profiles - tried reset in first instance and made no difference.

That's when then got them to log on to another PC and it worked fine so is machine specific, not user.

[Ralph1337]

Is this on the c drive? Because App data is within the user profile (which you've denied access to)

%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

[ITGURU]

If all PCs are made from the same image, why would it work for them on 99% of computers, but not this one?

 

 

Is this on the c drive? Because App data is within the user profile (which you've denied access to)

%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

[Ralph1337]

gpupdate /force?

 

If it is machine specific make sure the LAN is on 100mb and not 10. Had a similar issue with machines not updating group policy because it'd pulled down the wrong LAN driver (despite them all being the same image).

 

Change the network cable/port.

 

I'm just spit balling here.

[ITGURU]

If I change the policy to remove the restriction, reboot then have full access.

Re-apply policy - blocked again on that specific PC so know the policy is working..

Looks like a re-image to see if resolves.

[Ralph1337]

Is this Pc a member of a specific group or in a different OU?

[ITGURU]

Same OU as all other computers , even the PC next to it that I login with the same user is in the same OU./groups.

[Ralph1337]

Identical machines?

Swap the drives?

[Pyroman]

Just in case this pops up again, the problem is the shortcut on that machine is trying to run from %userprofile%\desktop and being blocked. I'd wager that on the others it's running from the public desktop and so not being restricted