Scripts on TS implementing "Software Restriction Policies"

[paidtoplay]

I want to implement "Software Restriction Policies" on my Terminal Services server, yet still allow execution of any batch/cmd/vbs files as logon/logoff scripts.

Even when I include a path rule for:
\\domainname\sysvol\policies\domainname\GUID\user\logon\*.*
the script will not run. Instead I get the message "Windows cannot open this program because it has been prevented by a software restriction policy".

There is no problem running the script when I set the default action of Software Restriction Polices to 'Unrestricted'. This script involves nothing more than a couple of drive mappings and as 'net.exe' is in the System32 directory with a matching path rule, I don't see why that would be a problem. Likewise for cscript.exe and wscript.exe

Any ideas?

 

[GuyThomas]

If I'm reading the problem correctly, it could be that the script is in the wrong place?

Here is a method I use to assign scripts.

http://computerperformance.co.uk/Logon/Logon_Script_Troubleshooting.htm

 

[paidtoplay]

Thanks for the reply. I've checked for that by setting the default for Software Restriction Policies to "Unrestricted" and the script runs exactly as expected. It's only when the default is set to "Disallowed" that the script doesn't run so I am fairly sure it is in the right location.

What I am wanting is a computer which won't run any applications except those located in specific paths defined by the path rules. This new group policy setting would seem to promise that but either there is more to it than I realise or it doesn't seem to work as the Help says it should.