Group Policy: Software Restriction Policy Help

[Jazket]

i've been trying to secure up my computer. the Software Restriction Policy is good, but the fact is, that for me is way too good and it ends up disallowing some software i want to run without any problem.

i just decide to get rid of that, but i cant find how!!!!

any help!!! plz!!
thanks...

i dont know if after making that change to the gpedit its not posible to undo, and i wont try system restore beacuse i dont use that stupid stuff, its disabled in my pc...

 

[linney]

Group Policy setting.

Local Computer Policy/ Computer Configuration/ Windows Settings/ Security Settings/ Software Restriction Policies/ Security Levels

Select "Unrestricted" for Software access rights to be determined by the access rights of the user.



Description of the Software Restriction Policies in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310791&FR=1&PA=1&SD=HSCH

See "Software restriction policies" in the Help and Support program.

 

[bcastner]

I am guessing that the Group Policy you made no prevents you from using some software thus preventing you from changing even Group Policy.

http://support.microsoft.com/default.aspx?scid=313222

In the future you can set policies that apply to everyone but the Administrator:

http://techrepublic.com.com/5100-6270-1040230.html

http://www.jsiinc.com/SUBL/tip5600/rh5619.htm

http://www.theeldergeek.com/gp07.htm

 

[Jazket]

Thanks for your help guys. But still i think that in a way or another is messin up my software, even my internet, i dont know why, but after that, now MSN Messenger does not let me log in and shows me the 0x81000303 error about the wrong name or password.

I made a new "Path" in the Group Policy/Software Restriction Policy but still it dont work.

Well, ne wayz im staring to think in formating. . I don't kno yey.

 

[linney]

You Cannot Access Your MSN E-mail Account or Authenticate with a Web Site in Various Programs

http://support.microsoft.com/?kbid=813951

Troubleshoot Situations Where You Cannot Connect to Secure Web Sites by Using Internet Explorer in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;813444

Plenty of similar errors here.

http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=0x81000303+Messenger

http://groups.google.com/groups?sourceid=navclient&ie=UTF-8&q=0x81000303+Messenger

 

[kendaukcat]

I am encountering a simliar issue. I have locked down access to all applications accept winword.exe, excel.exe and iexplore.exe.

...only problem is that I did not activatre Office 2K3 before doing this. This process is dependent of Windows installer, which I also removed via Group Policy.

Now I cannot run anything...command prompt, gpedit.msc...nothing. Is there a way around this or do I have to re-install?

Safe Mode rovided no love either.

Thanks in Advance for the help.

Ken

 

[linney]

kendaukcat,

See if jumping in at step 5 of this article is possible and even applicable?



Step-by-step guide: Filter to prevent administrator lockouts.

http://searchnetworking.techtarget.com/tip/1,289483,sid7_gci843037,00.html?FromTaxonomy=/pr/1295

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=313222

 

[Happo]

Now I cannot run anything...command prompt, gpedit.msc...nothing. Is there a way around this or do I have to re-install?

Bill, if I understand correctly, kendaukcat cannot access the command prompt in order to utilise that mskb.

 

[bcastner]

In iexplore, use the address bar file:// form to execute a program.

Otherwise, reinstall XP.

 

[linney]

file:///C:\WINDOWS\system32\cmd.exe

 

[bcastner]

Thanks linney. My fingers were slower than my thinking.

Some other thoughts. I have not tested these, as I never happened to create a situation in which the local and native Administrator was completely blocked.

But I thought last night what I would do if this happpened. You are invited to trial my suggestions:

. Use the ability of gpedit.msc to edit the policy of a remote computer. It can load the registry hives, you can edit them, and save them.

http://www.microsoft.com/resources/...2003/standard/proddocs/en-us/gpedit_start.asp

. create on a second machine a Linux bootable XP-Pre install image that allowed FAT32 and NTFS disk image editing.
My choice:

http://www.windowsubcd.com/index.htm

I would then do: Delete the Registry.pol file that is located in the %Systemroot%\System32\GroupPolicy\user\Registry.pol
Every instance.
Restart XP in normal mode.

. Access the workstation remotely as Administrator.
. do the above; or,

. Access the workstation remotely and use:

http://www.beyondlogic.org/solutions/trust-no-exe/trust-no-exe.htm

. Access the workstation remotely and try again to revert the secpol file. I would use PsExec:
One other option is to use a stand-alone Linux bootable repair tool, and remove the entry for the group policy settings.

http://www.sysinternals.com/ntw2k/freeware/pstools.shtml

 

[kendaukcat]

Thanks for all of the tips...unfortunately, trying to launch a command prompt or gpedit.msc through IE results in the same error message.

I am just going to re-install as that is probably the path of least resistance...just wnated to pass this along so others do not make the same mistake I did...tread softly when restricting software!

Thanks again, gang.

Ken

 

[Jazket]

I am just going to re-install as that is probably the path of least resistance...just wnated to pass this along so others do not make the same mistake I did...tread softly when restricting software!

i started this thread long ago n everybody was nice n tried to help me out. Thanks a lot. and i c you were having the same issue.. well, i re-installed and now its all good , i will never mess with GPEdit when being in Administrator , or just not to mess with the Software Restriction policy... its freakie n confuses, n by times it does whatever it want

Thnkz all!, n ken, re-install is good option