up vote 1 down vote favorite
share [g+] share [fb]

I have configured group policy to block all applications but certain ones. I have configured a certain to be allowed to run. But when the user tries running it they still get the usual group policy blocked this application message. Where can I look for more logging information on what group policy blocked and why? I'm thinking the application launches some other executable that I need to add to the list but I have no idea how to find it.

link|improve this question
feedback

4 Answers

up vote 3 down vote

You don't specify what client OS you're working with, but in W2K3 you'll need to look for EventID 865 from source Software Restriction Policies in the Application event log. The details of which should be similar to the following:

Access to C:\WINDOWS\system32\ctfmon.exe has been restricted by your Administrator by location with policy rule {bcb5037f-a1ff-45d0-9cfc-11fae74fb878} placed on path C:\WINDOWS\system32\ctfmon.exe

EDIT

In addition, you don't specify how you're blocking applications. Are you using Software Restriction Policies or the "run only allowed Windows applications" or the "don't run specified Windows applications" GP settings? I'm assuming you're using software Restrictions Polcies and that you're whitelisting the applications that are allowed to run. If so, what is your Enforcement setting, what are your Designated File Types, and what Additional rules do you have set up? Are you using path rules or hash rules?

link|improve this answer
feedback
up vote 1 down vote

It should be right in the System event log. If that fails, you could always install Proccess Monitor and capture what is being launched when the app starts.

link|improve this answer
Nothing is being logged in the System log. Also we did the Process Monitor install and added all the exes it listed and still nothing. Is there someplace else where things are logged like this? – mpenrow Oct 10 '11 at 16:30
If procmon isn't showing anything, you could call support for the vendor, or just search for *.exe in the program files folder. That will likely show all possible exes that the application would launch. – MDMarra Oct 10 '11 at 16:36
feedback
up vote 0 down vote

Sorry if I'm teaching you to suck eggs, but are there other EXEs associated with the application (Do a search in all of its folders). That's normally the cause in my experience.

You might also try using a path exception rather than hash rules.

link|improve this answer
feedback
up vote 0 down vote

If you would like enhanced logging then add the following registry setting on the target computer:

Path -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Key -> LogFileName = "C:\srpLog.txt"

This provides the most verbose logging.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.