Software Restriction Policies not applying

[ITManLT]

Hello All,

 

Currently scratching my head with this one. We have software restriction policies in place which have been working fine in the past (Windows 10 1903).

We noticed yesterday that a student in an IT lesson (clearly not doing a lot of work) decided to install Firefox and some random AutoClicker to get a high score on a game online..... (marvelous use of time).

 

I did some testing as one of our student accounts and found that anything I downloaded - I could run... From any folder in my N: Drive.

I have double checked our Software Restriction Policy in Group Policy and the N:\ drive is listed as a Disallow as expected.

Within Group Policy I used the Group Policy Modelling Wizard to see which policies would apply with our test student on this machine and it shows that the Software Restriction Policy should be applying.

The strangest thing is that if I log on to the computer as an admin and do a Resultant Set of Policies and choose the student test account - it shows no Software Restriction Policy being applied, and that the Security Level is set to Unrestricted!

 

I can't figure out why this SRP is not applying.

I have checked the local administrators group to see if for some reason our students group is in there, nope - just the admins we would expect.

The other strange thing is in the second image, where you type an administrator account, if they just press no - IT STILL PROCEEDS WITH THE INSTALLATION!?

 

This is obviously a pretty big security concern for me at the moment - does anyone have any ideas as to why this may not be applying?

Some photos below for information too..

 

Thanks for any assistance!

 

[BOOT]

Are the GPO permissions correct?

[ITManLT]

Yep they look to be. Set to apply to a computer group called standard security. The computers are in that group.

Checked the GPO Delegation tab and it shows standard security group having "Read (from Security Filtering)" permissions.

 

If the permissions were not set correctly, the group policy modelling would have picked this up as a denied GPO with the reason showing "Access Denied (Security Filtering)". So it's definitely fine permissions wise here I think.

[djm968]

Anything in the event logs?

[jthompson]

Couple of things to try...

 

Are the computer configuration settings of the GPO enabled (i.e. not disabled)?

 

Try adding 'Authenticated Users' to the security filtering of the GPO if it isn't already.

[ITManLT]

Just double checked the specific event logs for group policy - interesting one actually.. The Microsoft > GroupPolicy event log shows the below:

EventID 5313:

The following Group Policy objects were not applicable because they were filtered out : Software Restrictions Denied (Security)

 

__________________

Despite the fact that it is in the correct security group and Group Policy Modelling from the server shows it should apply...

[ITManLT]

@jthompson thanks for the reply. Authenticated users are on the GPO with read. And yup, GPO status set to User Configuration Settings Disabled - which should be fine as it's a computer config we're applying.

[jthompson]

Have you tried running gpresult on an affected machine rather than using RSOP? If your SRP is set to not apply to admin users, an admin user will still see the GPO getting listed in a gpresult report as the winning GPO for SRP settings. You can therefore run the following as an admin and see what the report gives you.

 

gpresult -h gpres.htm && gpres.htm

[houlta]

Does gpresult /r give a clue?

Does it only happen with computers in the standard security group?

[ITManLT]

GPResult show it being listed as a denied GPO..

 

It has prompted me to check the GPO settings again but as shown in the attachment, these look fine too..

GPO Security Settings - Standard Station Security apply

Members of Standard Station Security:

 

 

It all looks to be set up correct to me.

 

Thanks for the replies so far.

[jthompson]

Perhaps try creating a copy of the GPO, applying that and testing things again? Failing that, build a new GPO from scratch and if that works, use that instead, if only so that you've got a functioning SRP whilst you scratch your head over why the original isn't working.

[ITManLT]

Thank you for the replies to this thread.

Just to come full circle and in case anyone has this problem in future.

 

I have managed to get the Software Restriction Policy working as @jthompson suggested by copying the GPO to create a new one and selecting "Use the default permissions for new GPOs" when pasting the GPO.

I then edited the scope/delegation tabs to match how we had the existing Software Restriction Policy applied (including the deny apply for our domain admin accounts).

This GPO is now applying fine - with the exception of it's now ignoring the deny for our domain admin accounts.. so we cant install anything without right clicking and run as administrator!

We will accept this for now, at least we have a working SRP again.

[Guest Guest]

Have you considered migrating to AppLocker? You get far more control over what users are able to run

[Cache]

This GPO is now applying fine - with the exception of it's now ignoring the deny for our domain admin accounts.. so we cant install anything without right clicking and run as administrator!

 

I think that's by design, as the domain admin will run as a normal user until elevated as with a local administrator.

[ITManLT]

Have you considered migrating to AppLocker? You get far more control over what users are able to run

 

Until running into this issue - nope, as SRP was running perfectly fine.

I may look into it now as I read a few places that Microsoft are trying to phase out SRP as we know it in favour of AppLocker anyway. Now we have the SRP working again I will test an AppLocker policy and perhaps migrate in the future.

 

 

Thanks.