Inconsistent Software Restriction testing

-

we have terminal server deploying, , wanted use group policy lockdown besides our normal terminal lockdown policy.  have policy cryptlocker type things launching in temp locations, wanted more comprehensive that.

this pretty simple environment, handful of known programs allow.  wanted set default deny , allow things in our additional rules run.

it *should* pretty straightforward had thought, it's been frustrating.

i started out doing via 2012r2 dc.  created policy , applied ou terminal server sits in.  applied single user though testing, since developers on here getting application set up, didn't want apply 2 rdp groups have created this.

i tried doing via user configuration, nothing happened whatsoever when user logged in.  tried via computer configuration section.  , got flakey on me.  applied ignored rules.

i had set "disallowed" default security level.  left 2 ms rules in place start, systemroot , programfilesdir registry key location rules.

so first seeing in multiple posts on various forums putting program folder path rule allow in subfolders run.  appeared not function way, tried folder, several exe's in it, without specifying exe's, c:\foldername

no joy.  tried explicitly giving path program , allowing run unrestricted.  , then, after doing gpupdate / force on terminal in question, after updates, logging in user that's in scope settings of policy security filtering, things absolute paths , exe names give me error blocked group policy.

my other policies working great, redirection of start menu , such, , generic lockdown  policy.  reason i'm having nasty time software restriction policy, , can't function.

google searches turning billion things aren't useful, , after 4 hours of searching , testing, i'm no better off when first started trying today. 

i'm hoping have obvious i've overlooked, i.e. "for work,  first have set a, b."

enforcement set on sofware files except libraries, users except local administrators (since account that's being tested not admin account) , set ignore certificate rules.  trusted publishers blank, , designated file types default list.

disallowed default setting security levels.

and example of additional rule fails testing: c:\windows\system32\calc.exe

it set unrestricted security level.

yet when try run calculator, tells me it's blocked policy.  once disable test restriction policy, works fine again.

thanks leads.

john

john

hi john,

thanks post.

disallowed default setting security levels.

and example of additional rule fails testing: c:\windows\system32\calc.exe

it set unrestricted security level.

yet when try run calculator, tells me it's blocked policy.  once disable test restriction policy, works fine again.

>>>i have tested this. default setting security levels disallow , unrestricted security level. can run calculator without blocked message.

based on experience, suggest check if have configured srp disallow default security level on computer.

i have tested in scenario below , encounter same problem you.

  1. configure srp computer object disallow default security level
  2. configure srp user object scenario above descripted
  3. when run calculator, blocked message prompt

best regards,

jay

please remember mark replies answers if , un-mark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.



Windows Server  >  Group Policy



Comments

Post a Comment

Popular posts from this blog

Error: 0x800f080c - Feature name NetFX3 is unknown

-
i trying install .net framework 3.5 on windows server 2012 standard using command below: ps c:\users\administrator> dism.exe /online /enable-feature /featurename:netfx3 /source:f:\sources deployment image servicing , management tool result: version: 6.2.9200.16384 image version: 6.2.9200.16384 error: 0x800f080c feature name netfx3 unknown. a windows feature name not recognized. use /get-features option find name of feature in image , try command again. the dism log file can found @ c:\windows\logs\dism\dism.log option install .net framework not appear in server manager. how can .net framework 3.5 install? seems impossible install .net framework 3.5 have tried suggested solutions dism /online /cleanup-image /restorehealth, without success.  have run get-windowsfeature , .net framework 3.5 not appear: display name                                ...
Read more

Checkedlist box

-
hi all, i tired creating checkedlistbox allow users selecting multiple inputs simultaneously. trying perform on check/check activity starting displaying selected item user. below sample code created. code not working believe have not selected correct onclick activity. great if can suggest me correction. $colourlistbox = new-object system.windows.forms.checkedlistbox $colourlistbox.location = new-object system.drawing.size(1,20) $colourlistbox.size = new-object system.drawing.size(140,50) $colourlistbox.sorted = $true $colourlistbox.backcolor = "lightgray" $colourlistbox.forecolor = "blue" $colourlistbox.checkonclick = $true $colourlistbox.height = 50                                         [void] $colourlistbox.items.add("red")   ...
Read more

schannel

-
que tal. checando nuevamente en mi visor de sueceso e aparece el siguiente error: el certificado recibido del servidor remoto fue emitido por una autoridad certificadora de confianza. debido esto, ninguno de los datos contenidos en el certificado puede ser validado. la solicitud de conexión ssl ha fallado. los datos adjunto contiene el certificado de servidor. tengo un server 2003 alguien me puede ayudar para saber de donde proviene este error. gracias debes describir la situación, acá no podemos adivinar cómo, cuándo, con qué sistema, qué aplicación, cuando haces qué, etc. etc.   guillermo delprato - buenos aires, argentina mvp-mct-mcse-mcsa mcitp: enterprise/server administrator mcts: active directory/network/applications configuration este mensaje se proporciona "como está" sin garantías de ninguna clase. usted asume todos los riesgos. ...
Read more