Software Restrictions

[nicholab]

Anyone got some suggestions for a good software restriction policy?

 

 

I will just let user have access to the program share and windows stuff. What else do I need to make windows work.

[maniac]

My software restriction policy is disallow everything by default, then allow the entire C:\ and disallow specific programs like regedit, cmd, command.com etc.

 

You also might have to allow the sysvol and netlogon paths so logon scripts can run properly.

 

Mike.

[morganw]

if you set rules for for %systemdrive% and %programfiles% then you are covered for alternate drive setups where things might not be on C

[ajbritton]

Software Restriction Policy

Here's the setup I used. Obviously students are set as limited users only.

 

The LNK extension has been removed from the Computer and User default SRP policies so that items on the start menu/desktop can be launched. There are other ways to achieve this, but this seemed easiest for my setup. I do not use redirected start menus/desktops for students. Students get a mandatory profile but to not see the 'all users' desktop/start menu by default. Instead a logon script copies approved items from the all users desktop/start menu into the student desktop/menus at every logon.

 

Computer Policy (for all computers that students will use)

- Default SRP policy

- Remove LNK from the list of designated file types

 

User Policy (for all students)

- Default SRP policy

- Enforcement: Apply SRP to: All software files except libraries (such as DLLs)

- Enforcement: Apply SRP to the following users: All users except local admins

- Designated file types: Remove LNK

- Default security level: Disallowed

Default Path Rules

- %HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRoot%: Unrestricted

- %HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe: Unrestricted

- %HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRoot%System32\*.exe: Unrestricted

- %HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

: Unrestricted

Custom Path Rules (NB - The students only have read access to these locations)

- \\(servername)\apps: Unrestricted (networked applications / ISO images)

- \\(servername)\install: Unrestricted (managed software MSIs etc)

- \\(servername)\public: Unrestricted (public area)

- \\(servername)\sysvol: Unrestricted (required for logon)

- \\(DNS domain name)\sysvol: Unrestricted (required for logon)

- C:\OLDAPPS: Unrestricted (Any PC apps which don't like running from C:\Program Files are installed under OLDAPPS. Again, students only have read access to this folder by default.

 

If you have any naughty applications that need write access to their program folder (under C:\Program Files or C:\OLDAPPS), then permissions can be altered as required and an additional path rule added to prevent execution from that folder.

 

It is possible to use environment variables (eg %USERPROFILE%) in path rules, but avoid this as the value of an environment variable can sometimes be modified by the user.

 

This was my first time with SRP, so I don't claim this list to be definitive in any way!! It seemed to work OK for me though.

[nicholab]

Thank for your help. I was going down the right road but I found I had two other policy setting the default as allow.