Software Restriction GPO Problem

Software Restriction GPO Problem

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Software Restriction GPO Problem Jeff Field 08-29-2005
Posted by =?Utf-8?B?SmVmZiBGaWVsZA==?= on August 29, 2005, 4:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello,
I have a Software Restriction policy going for my OUs and it is working
great except for one problem - though I have removed LNK/URL files from the
list of restricted extensions, it has had no effect. I've tried adding them
back in and removing them again. I know I am in the correct area of the GPO
(User\Windows\Security\Software Restriction Policies) but changing it has no
effect, and I don't have any other Software Restriction Policies, they only
exist within this OU. Is there something I am missing that I need to do to
exempt LNK/URL files other than remove them from the list?

If I specifically exempt these files using a path entry, it works, but only
for whatever directory I specifically state in the policy, and I would rather
not do that as I would like the users to be able to organize their shortcuts
in folders and such. Does anyone have any experience with this sort of
problem?

Thanks,
-Jeff

Posted by =?Utf-8?B?V29uZyBUdWNrIFdhaA== on August 29, 2005, 11:16 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

Hi Jeff,

i have no idea why you need to remove the 2 file extensions from the list.

The Designated File Types dialog box lists the file types to which the
software restriction policy applies. The designated file types are file types
that are considered executable.

The rules in a software restriction policy only apply to the file types
listed in the Designated File Types dialog box. If your environment uses a
file type that you want to be able to set rules on (be it allow or deny), add
it to the list, otherwise the rule will not apply.

HTH.




Posted by =?Utf-8?B?RnJhbmsgRw==?= on September 2, 2005, 4:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi again Jeff,

As a workaround, you can add a path rule with "*.lnk" int it, it will have
the same effect as removing the ".LNK" from the Designated File Types.

Guess this is "by design" !

from :
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
"The list of designated file types in the machine policy, if present, is
used. If not present, the list of designated file types in the user policy is
used."

--
Frank G
MCSE NT4/2000/2003



"Jeff Field" wrote:

> Hello,
> I have a Software Restriction policy going for my OUs and it is working
> great except for one problem - though I have removed LNK/URL files from the
> list of restricted extensions, it has had no effect. I've tried adding them
> back in and removing them again. I know I am in the correct area of the GPO
> (User\Windows\Security\Software Restriction Policies) but changing it has no
> effect, and I don't have any other Software Restriction Policies, they only
> exist within this OU. Is there something I am missing that I need to do to
> exempt LNK/URL files other than remove them from the list?
>
> If I specifically exempt these files using a path entry, it works, but only
> for whatever directory I specifically state in the policy, and I would rather
> not do that as I would like the users to be able to organize their shortcuts
> in folders and such. Does anyone have any experience with this sort of
> problem?
>
> Thanks,
> -Jeff

Similar ThreadsPosted
Additional Software Restriction Policies: Basic User, Untrusted, Restricted December 7, 2006, 1:10 am
Server access restriction June 30, 2005, 10:16 pm
EFS restriction of Administrator on Server 2003 July 8, 2005, 3:25 am
Account logon time restriction violation March 31, 2008, 11:31 am
The problem is Free Anti-Virus and free spy ware software does not WORK !! January 6, 2008, 9:09 pm
IBM Fingerprint Software July 9, 2005, 6:44 pm
Win Software Corporation, Inc. December 7, 2005, 3:55 pm
Which software has these functions October 2, 2006, 7:42 am
can't run virus software October 9, 2006, 5:51 pm
Too much security software? April 12, 2007, 10:24 am

The site map in XML format XML site map

Contact Us | Privacy Policy