Software Restriction Policies also applying to Administrator

[db2995]

Hello,I've been looking into implementing Software Restriction Policies via Computer Configuration and it seems OK. I've included a Disallow All rule with it being applied to All Users Except Local Administrators.

 

However, I do have a problem where if I add another user solely to the 'Administrators' group via Computer Management, that particular user is actually blocked from running executables. I have tried it both via our Domain (in a test environment) as well as locally (machine not joined or previously joined to a domain) via Computer Management (including creating a local user and Local Group Policy) but to no avail.

 

This is what I've found:

- Can run .exe files as Administrator by right clicking (fine with that).

- Blocked from running .BAT files.- Blocked from running .VBS files.

- Blocked from running .MSI files.

- Can only run executables within the white listed locations.

 

I have however found a workaround by changing the following setting:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options >>> UAC: Run All Administrators In Admin Approval Mode = Enabled > Disabled

 

Are there any implications of doing it this way? Is there a more recommended method to use or would it be better to simply just use the built-in Administrator account if needing to do stuff locally?

 

Many Thanks

David

Edited June 13, 2017 by db2995

[ADMaster]

To run scripts and MSIs I use an elevated command prompt, this should solve the immediate issue. However is there any reason your not using applocker? It is much more flexible on allowing access based on usergroup, more details for signed apps etc. It also has separate lists for exes, scripts, installers and packaged apps.

[db2995]

Hi,

 

We can't use AppLocker as we have Professional rather an Enterprise.