Win10 Software Restriction Policy applying to Domain Admins

[ITManLT]

Hello All,

 

We have had RM CC4 removed this Summer and (with a few tweaks) things are working great, except for the fact that we as Domain Admins seem to be getting the SRP applied.

I have checked over this and there is 1 GPO named Software Restriction.

 

This is GPO is applied to All Desktops. - okay

In the Enforcement is set to "All users except local administrators" - sounds good.

Check the Local Administrators group on a random PC, "domain\domain admins" is in here - cool

Check domain\domain admins group, my account is a member - fantastic, shouldn't be applying to me - but it is....

 

Does anyone have any thoughts/pointers on this please? for most things we have managed to get around this with Right Click > Run as Administrator. This has been okay up until now having to install A2C for the exam results... when using Runas Administrator, it launches in the Administrator's context which doesn't have the S:\ drive mapped (where the ExamIN and ExamOUT folders are) and fails saying incorrect S: drive.

 

Any help with disabling SRP for domain admins would be greatly appreciated.

 

Thanks.

[kmount]

On the GPO itself look at the delegation tab and then click advanced the nscroll down to your domain/ent admins and tick deny on the apply group policy.

[ITManLT]

Thanks for the reply kmount. Just given this a try but that didn't work.

Ran a Group Policy Modeling Wizard on my account on a computer and that still came back as applying it, same in RSOP.

 

I suspect it may be because this Software Restriction Policy is set up as a computer policy, not a user policy. This was a baseline left by RM when CC4 was removed, I'm just wondering now if there would be any reason this was applied as a computer policy not a user policy? Any thoughts as to why that may be?

[kmount]

Whilst it is a computer policy (i.e. applied to computers) are the SRP settings under Computer Config or User Config?

 

(if they're under User Config the method above should work, if they're under Computer Config I suspect that could indeed be your problem)

[ITManLT]

This is indeed currently under Computer Config not User Config.

 

Just wondering now if there is any particular reason that I'm unaware of why it would be a computer config and not a user config

[kmount]

I theorise its so they could apply it differently to servers, or computers, etc without relying on loopback processing.

[DJ-1701]

As @kmount stated, place it under user policy. It's to do with the administrator tokens, until such time as you are actually running the program as an administrator with the full rights it won't bypass unless you disable UAC. So changing it to user policy would get around that. Only issue would be if you create local, non domain accounts which you want to lock down with the SRP restrictions.

[ITManLT]

Sure, that makes sense.

 

Final question on this before I go ahead and change it over to a User Config, applied to everyone except domain admins.

 

Aside from what @DJ-1701 has just said regarding local non-domain accounts, Is there any general pros and cons in favour of setting a software restriction policy as a computer configuration vs user configuration?

 

Thanks

[kmount]

I guess their thinking is that by having it as a computer policy you are targeting ALL users on those computers so if you wanted a different policy for ALL users on different PCs you would duplicate the policy for those.

 

By doing it in the user policy by default it will be those users on ALL computers unless action is taken to exclude it.

[ITManLT]

Hello Again,

 

Just gone to change this over to a User Configuration instead of a Computer Configuration and I have exported the Software Restriction Policies to a CSV from Computer Configuration.

I cannot see anywhere to import this CSV under the new User Configuration Software Restriction Policy.

 

Is there a way to import this CSV or do I have to put these rules in manually?

 

Thanks.