Search the Community

Hi Guys im setting up a software restriction policy for september to stop the little angels from running games off memory sticks and etc. We are going for a complete restriction all programs unless we specify them. We have allowed all windows based programs Office etc and we have list off all programs on out network my question is wether is hould use a "hash" rule or a "path" rule for them. Both seem to have there pro's and con's. Has anyone implemted the above how do they find it and which rule did they use?

Hello All, Currently scratching my head with this one. We have software restriction policies in place which have been working fine in the past (Windows 10 1903). We noticed yesterday that a student in an IT lesson (clearly not doing a lot of work) decided to install Firefox and some random AutoClicker to get a high score on a game online..... (marvelous use of time). I did some testing as one of our student accounts and found that anything I downloaded - I could run... From any folder in my N: Drive. I have double checked our Software Restriction Policy in Group Policy and the N:\ drive is listed as a Disallow as expected. Within Group Policy I used the Group Policy Modelling Wizard to see which policies would apply with our test student on this machine and it shows that the Software Restriction Policy should be applying. The strangest thing is that if I log on to the computer as an admin and do a Resultant Set of Policies and choose the student test account - it shows no Software Restriction Policy being applied, and that the Security Level is set to Unrestricted! I can't figure out why this SRP is not applying. I have checked the local administrators group to see if for some reason our students group is in there, nope - just the admins we would expect. The other strange thing is in the second image, where you type an administrator account, if they just press no - IT STILL PROCEEDS WITH THE INSTALLATION!? This is obviously a pretty big security concern for me at the moment - does anyone have any ideas as to why this may not be applying? Some photos below for information too.. Thanks for any assistance!

Hello All, We have had RM CC4 removed this Summer and (with a few tweaks) things are working great, except for the fact that we as Domain Admins seem to be getting the SRP applied. I have checked over this and there is 1 GPO named Software Restriction. This is GPO is applied to All Desktops. - okay In the Enforcement is set to "All users except local administrators" - sounds good. Check the Local Administrators group on a random PC, "domain\domain admins" is in here - cool Check domain\domain admins group, my account is a member - fantastic, shouldn't be applying to me - but it is.... Does anyone have any thoughts/pointers on this please? for most things we have managed to get around this with Right Click > Run as Administrator. This has been okay up until now having to install A2C for the exam results... when using Runas Administrator, it launches in the Administrator's context which doesn't have the S:\ drive mapped (where the ExamIN and ExamOUT folders are) and fails saying incorrect S: drive. Any help with disabling SRP for domain admins would be greatly appreciated. Thanks.

Hello All, Just wondering if there is somewhere I can't see right in front of my eyes to import a CSV to a software restriction group policy? In Group Policy, I have exported the list from an existing Software Restriction GPO, and I just need to import this into a new one. The reason being is the Software Restrictions were set up as a computer configuration, so they are still applying to domain admins when logged on to PCs. I have created a new GPO to apply to users, and was hoping I could just export this list as CSV (which was straight forward) but I can't see anywhere to import from CSV. Thanks in advance.

I got a 4GB memory pen which has U3 software on it This makes it so that a password is needed to access its files. I use it daily but i have a problem using it at college. The network has restrictions saying i cannot "run" any software I really don't want to have to get another memory pen and i don't want to delete the software off this, Can i get round the "Run" restriction at college? Please Help. :D