Software Restriction Policy, where am I going wrong? [S2012R2, W10]

[Garacesh]

(Sorry if this is in the wrong place, there's no AD section of the forum.)

 

Since Windows 10 comes with Powershell pre-bundled, and the "Prevent access to the command prompt." policy doesn't change the behaviour of Powershell, I wanted to implement an SRP so users can't run it. Removing all links to it wouldn't be enough, since 'powershell' is a globally accepted reference* it would be fairly easy to create a shortcut to it, which by my current testing, does work.

 

Current SRP's settings are:

Enforcement


[indent]Apply software restriction policies to the following:
[indent][list]
[*]All software files except libraries (such as DLLs)
[/list]
[/indent]


Apply software restriction policies to the following users:


[indent][list]
[*]All users except local administrators
[/list]
[/indent]

[/indent]

Security Level


[indent]Unrestricted (thinking of changing this to Basic User)[/indent]



Additional Rules


[indent][b]%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%[/b]		Unrestricted
[b]%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%[/b]		Unrestricted
%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe				Disallowed
%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell_ise.exe				Disallowed[/indent]

 

Bold rules are there by default, supposedly to stop me borking the OS and locking all users out.

 

Now, given that RSOP, Group Policy Modeling and Group Policy Results all say it's applying fine (though logging in and clicking a shortcut proves this isn't the case..), I can only assume the issue is that the default rules are saying 'Everything in C:\Windows is legit', however this KB article (though is for S2003/XP) says the most specific policy should take precedence, so by my reading, everything in C:\Windows should be fine except the two exe's I've specified..

 

But it's not working. and my google-fu is weak today.

 

* I have no idea what this is actually called, but I'm referring to not needing to know its location to launch it, in the same fashion of launching 'explorer', 'mspaint', 'iexplore' etc without a path.

Edited April 15, 2016 by Garacesh

[Gaz]

My results looks the same as yours but you are missing some Powershell links. Sorry I can't be of more help. I assume you have tried gpupdate /force

 

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe

Security Level Disallowed

 

%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe

Security Level Disallowed

 

%windir%\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe

Security Level Disallowed

 

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Security Level Disallowed

 

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe

Security Level Disallowed

[FragglePete]

I've managed to block Powershell on the GPO level by doing

 

User Configuration > Administrative Templates > System > Don't Run specified Windows applications

 

In there I have listed powershell.exe and powershell_ise.exe along with things like notepad.exe, etc.

 

Searching for the App in Windows 10 search box brings up the icon, but does nothing if they click on it.

 

Pete