Help with Software restrictions Policy

[speckled]

Hi all, i hope someone can help with this problem i am having trying to use a Software restrictions Policy, i want to disallow all software apart from the list i specify. If i allow all and just add a program i do not want to run it works fine, if however i reverse this to disallow all and add a program i want to run in additional rules via path or hash it just disallows everything...and i am left scratching my head.

[User3204]

There's a whole lot of stuff here Using Software Restriction Policies to Protect Against Unauthorized Software about SRPs.

 

I found if I make changes I need to get the users to logoff/logon to re-apply the GPO / ADM policy.

The best way to do it is to create a completely new GPO, on a few test users, and then work out all the shared areas you have to allow access to, there's stuff like:

 

\\servername\netlogon - to run logon/logoff scripts..

\\servername\programs & p:\ or whatever you map the \\servername\programs to;

c:\program files\*\* is one I allow, which seems stupid until you realise we have stopped installers running, and hide the c:\ drive;

c:\windows\ - just in case...

[DMcCoy]

You may want to use \\domain.name instead of server name as you can use the one entry for all DCs then (assuming you then also use it when running the scripts).

 

Program Files and Windows folders should be covered by the default reg key rules that get added for you.

 

If you use default deny then you will need to allow %allusers% and %userprofile% otherwise the exe's are allowed but shortcuts are not. You may wish to disallow temp and tempory internet files again after adding the %userprofile% path.

 

After that it's just any application servers etc, I also have a drive allowed for App-V client but less than 15 rules total. *.mdb will need adding as even if you remove it from the extensions with default deny it still gets blocked.

Edited November 6, 2008 by DMcCoy
typo

[Gatt]

Yeah i tried a whitelist SRP and found that if you removed the default paths (mainly for Program Files, Windows, and System32 - odd things happen - including noone logging on due to userinit.exe not running!!

 

Had to delete the SRP and start again leaving the defaults

 

On other thing - x64 can have interesting effects on SRPs - had to go routing around the registry to find the environment variable for the Program Files (X86) Directory!

Edited November 6, 2008 by Gatt

[dhicks]

if however i reverse this to disallow all and add a program i want to run in additional rules via path or hash it just disallows everything...

 

Mine does that too. I left the default "allow" paths in, added the hashes for Word and IE executables, set the default security setting to "disallow" and reset the machine. Darned thing refused to run Word or IE.

 

--

David Hicks

[DMcCoy]

Mine does that too. I left the default "allow" paths in, added the hashes for Word and IE executables, set the default security setting to "disallow" and reset the machine. Darned thing refused to run Word or IE.

 

--

David Hicks

 

Running word from the exe or from a shortcut? As I mentioned above, with disallow all being default, the automatically added rules do not allow the shortcut lnk files to be run.

[dhicks]

Running word from the exe or from a shortcut? As I mentioned above, with disallow all being default, the automatically added rules do not allow the shortcut lnk files to be run.

 

Oh. Oh - ah! Light dawns! I get it now! Thanks for that!

 

--

David Hicks

[speckled]

Great stuff!....now works a treat, just had to add the filder with all the shortcuts in and voila.