Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I set 'only allow certain applications' restrictions and accidentally applied them across the board to all accounts. Now I'm restricted to only running a browser and can't run the group policy editor!

Is there a backdoor I can make use of?

share|improve this question
    
Where did you apply that policy? The domain level, site level, OU level? –  Cheekaleak Apr 17 '12 at 22:51
    
I'm actually not sure. My understanding is that I was only applying it to users but not administrators. –  Darren Apr 17 '12 at 23:04
    
The domain administrator account, if it still resides in the Users container should be alright as policy may only be linked to OUs. That is, unless you made this change to the Default Domain Policy. –  jscott Apr 17 '12 at 23:27
    
Can you log into Administrator account? –  The_aLiEn Apr 17 '12 at 23:36
    
Yep. The problem is that the policy has somehow applied to my administrator account. –  Darren Apr 18 '12 at 0:00

7 Answers 7

up vote 5 down vote accepted

Found a workaround that exploits an obvious hole in the 'restricted applications' feature of Group Policy. By simply renaming an executable to the filename of a trusted application, you can bypass the policy.

The workaround I arrived at is below (you would many similar/simpler variants of this to work; they doesn't). Hopefully this helps someone.

  1. Rename a copy of 'cmd.exe' to something permitted e.g. 'chrome.exe'
  2. Also rename a copy of 'mmc.exe'
  3. Use the now-functioning command-line to launch the management console
  4. From the management console, add the Group Policy snap-in
  5. Fix your careless mistake

The management console won't run from explorer once it's been renamed, so the command-line step is necessary.

share|improve this answer

I assume you have software restrictions in the User Configuration part of the policy. A few tips here:

1. Copy to another location If you have a restriction based on a path location, you can copy the file that is restricted (mmc.exe?) to another drive (or rename the file) and try running it from there.

2. Cached credentials If you have a computer or laptop where you have previously logged on to, unplug the network cable and logon with cached credentials (if allowed). When you are fully loggedon (you might want to wait for a few minutes) plug in the network cable again. Now you should be able to access the network, but the policies will not yet be applied, so you can access all programs.

3. delete registry keys All these policy restrictions are stored in the registry. As you are an administrator you have permissions to edit the registry, so you should find a way to edit it.

What you will do is go to the following registry key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Safer\CodeIdentifiers\0\paths and delete all keys under this key, leaving the key itself untouched.

If you are not able to start regedit.exe, you might be able to start the following programs:

%windir%\regedit.exe

%windir%\System32\regedt32.exe

%windir%\System32\reg.exe (commandline)

%windir%\SysWOW64\regedit.exe (64bit computer only) 

%windir%\SysWOW64\regedt32.exe (64bit computeronly) 

%windir%\SysWOW64\reg.exe (64bit computer only, commandline)

Otherwise try accessing the registry remotely.

share|improve this answer
    
1 & 2 don't apply in this case but I tested 3 just now and was able to run reg.exe from the command-line and it worked, thanks! However I found an easier way which is shown below –  Darren Apr 18 '12 at 13:01
    
I'm glad you found a solution. Renaming the file is the same concept as copying it to another location, I should have wrote 'Copy or rename' in step one. By the way, you can prevent the 'hole' if you like to, by adding a software restriction hash rule. –  ZEDA-NL Apr 18 '12 at 13:29
    
That sounds interesting - storing the MD5 hashes of the allowed software? Is this in Windows by default or does it require 3rd party? –  Darren Apr 18 '12 at 22:37
2  
Hash rules are native in Windows 7, Windows 2008 and Windows 2003 and maybe before. Just choose 'new hash rule' where you previously choose 'new path rule'. The downside is that it might stop working when you update your system. You can combine hash rules and path rules though. –  ZEDA-NL Apr 19 '12 at 7:22

That sounds like quite the catch 22. It sounds like you mucked with the Default Domain Policy by the sounds of it. If I'm not mistaken you're pretty well locked out because all users are members of the Authenticated Users group and will have the GPO applied unless you removed Authenticated Users from Security Filtering on the GPO (which doesn't sound like the case). There's no user/group combination that I can come up with that will get you back into the GPMC. As far as I can see, there's no way to get back in from the current domain if you've truly locked out your ability to run the GPMC and any other program/executable. I've never been in this scenario so there may be a way around it that I'm not aware of but here's a workaround I've come up with. It sounds a little kooky and slightly convoluted but I think it'll do the trick. Here goes:

  1. Set up a DC in a new Domain/Forest. I'll refer to this Domain/Forest as "new" and I'll refer to the existing Domain/Forest as "old" from this point forward.

  2. Create a trust between the new forest and the old forest. Since you probably can't access the DNS console in the old domain you should be able to edit the hosts file on a DC in the old domain by accessing it from a non-domain joined workstation (provide the appropriate domain credentials when prompted). Add an entry for the new domain (the domain DNS suffix/AD DNS zone name of the new domain) pointing to the ip address of the DC/DNS server in the new domain. Save the file and reboot the old DC to preload the hosts file entry into the DNS cache. This should be a passable substitute for a conditional forwarder from the old Domain/Forest to the new Domain/Forest. Create the corresponding conditional forwarder in the new domain for the old domain. Set up the hosts file and conditional forwarder before trying to create the trust.

  3. Add the Administrator account from the new Domain/Forest to the Builtin Administrators group in the old Domain/Forest by granting the Administrator account in the old Domain/Forest the "Allow log on locally" user right in the Default Domain Controllers GPO in the new Domain/Forest. Run gpupdate /force on the new DC and then use "run as different user" or "run as" (depending on the OS) on the new DC to open ADUC as the Administrator of the old domain and home ADUC to the old domain.

  4. Run GPMC on the DC in the new forest

  5. Home GPMC to the old Domain/Forest

  6. Unlink the Default Domain Policy in the old forest

  7. Log on to a DC in the old forest and run gpupdate /force and then see if you're now able to run GPMC. If so, undo whatever you did to lock yourself out and relink the Default Domain Policy

  8. Reverse the steps from above and then break the forest trust and decommission the new Domain/Forest

Editing the GPO across the Forest trust isn't possible (as far as I know) but unlinking it should be if you follow the steps I've laid out.

share|improve this answer
    
While, in theory, this sounds like it would work for some set-ups, I'm talking about a single machine not a domain here so this answer doesn't apply. But thank you! –  Darren Apr 18 '12 at 12:57
    
My bad. I thought this was in a domain. Carry on then. –  joeqwerty Apr 18 '12 at 22:27
    
Heh, sorry. I feel really bad that you went to all this trouble. I suppose I should've specified it was a single machine considering this is Serverfault. –  Darren Apr 18 '12 at 22:38

How about using powershell to remove the group policy link. Here's the command reference on technet http://technet.microsoft.com/en-us/library/ee461054.aspx

share|improve this answer
    
Tried that but because of the restrictions I wasn't able to install the RSAT tools that the Group Policy cmdlets require. –  Darren Apr 18 '12 at 3:41

I don't know if you could be able to run a .reg file... Windows is so registry related, so the group policies... It was RestrictRun value you've set I think. With a remove .reg file you can delete that key.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"RestrictRun"=-

Login to your own account. Run this reg file. And you should be able to run other programs after reboot.

I know it is not acceptable to upload files rather than images, but I'm sorry that you just have to trust me with this reg file, since you can't create it over any text editor...

share|improve this answer

Found a workaround that exploits an obvious hole in the 'restricted applications' feature of Group Policy. By simply renaming an executable to the filename of a trusted application, you can bypass the policy.

Only problem is that you can't directly access 'gpedit.msc' by renaming it: it won't work.

The workaround I arrived at: (you would expect a simpler variant of this to work; it doesn't)

  1. Rename a copy of 'cmd.exe' to something permitted e.g. 'chrome.exe'
  2. Also rename a copy of 'mmc.exe'
  3. Use the now-functioning command-line to launch the management console
  4. From the management console, add the Group Policy snap-in
  5. Fix your careless mistake

The management console won't run from explorer once it's been renamed, so the command-line step is necessary

share|improve this answer

VERY SIMPLE FIX

I had the same issue by accidentally changing system settings in gpedit. Try this fix I got from Greylox.... It worked for me.

Click start button, type run into the search field at the bottom of the popup press enter. In the new window enter %systemroot%\system32\GroupPolicy\User delete registry.pol

Do the same in %systemroot%\system32\GroupPolicy\Machine delete registry.pol if you see it, my PC didn't have it.

Reboot your system.

Log in under admin account, create a new user with admin privileges, reboot and log back in using the new admin account.

Click start button, type run into the search field at the bottom of the popup press enter. Type gpedit.msc, press enter.

Go to Local Computer Policy -> User Configuration -> Administrative Templates -> (double click) system -> (look in panel on the right and double click) run only specified windows applications. Click the radio button next to Disabled.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.