Software Restriction

[Chuckster]

I'm having a spot of bother with this. I'm trying to create a whitelist of allowed software and it's not working. Basically I have set the disallowed as the default and I find staff and pupils are still able to run bat, msi, exe files happily.

 

I've forced a gpupdate to no avail.

 

Typing in something like %Homeshare%\*.bat works but not at sub levels.

 

How has everybody else got the SRPs set up?

[flyinghaggis]

One thing that caught us out the last time we looked at software restriction policies was that they don't nest together well if you have the software restriction GPO enabled on several policies that all take effect on a particular user.

 

Ie. If you have a whole school all users software restrionion policy and one in a subfolder further down the tree where a PC is then you'll get very unpredictable results when policy is applied and the machine tries to combine both.

 

Don't know if this is something you've got setup in your AD which might be the cause of the weirdness you're noticing?

 

PS I'm not 100% sure SRP's can accept variablenames by the way ? We got all ours blocked on UNC paths and drive letters?

Edited June 17, 2009 by flyinghaggis

[Chuckster]

Thanks for the reply flyinghaggis.

 

I've got the SRP working now. It would seem there was a line in there called %SafeLocation0%\* which allowed users to bypass the filtering.

 

 

Out of curiosity, is anybody's SRP GPO assigned to the users OU or to the OU where all the workstations are kept? Also, are any of your SRPs in the computer configuration as well as the user configuration, or just the user part?

[User3204]

We have four SRPs on the student network (the staff network machines are trusted...hmmm).

1. Admin user OU (ICT Support staff, and a few trusted teachers).

2. Staff user OU

3. Student user OU

4. Programmers (applied to the Student user OU, but with permissions to only allow certain groups to use it).

 

 

These are GPOs with nothing in them except for the SRP definitions. The programmers one, allows them to run software from their home drive.

[madcyryl]

We just have the one restriction policy assigned to all workstations. it is its own group policy object with no other settings

[Chuckster]

^Is your SRP created under the computer configuration level or at user level?

[madcyryl]

^Is your SRP created under the computer configuration level or at user level?

 

Computer config level, i have disabled user config.

[ricki]

HI

 

I had the same thing to get it to do subfolders you have to put in many restrictions like

d:\*bat

d:\*\*.bat

d:\*\*\*.bat

you get the idea

I dont know why but it does work.

 

Also beware if students are getting at documents through other paths say my documents or mapped drives you have to do the same thing

 

Richard