0

in GPO, this item

Computer > Software settings > Assigned applications > IE8_package

was on Security tab set "Authenticated users" to "Deny". After that it disappeared from GPO, it is there, but nowhere shown.

The intention was to disable installation of that package for now, yet having other packages in that GPO still installed. I know it was stupid decision now.

Is there any way to display that package back? Please help.

Improve this question

2 Answers 2

Reset to default
1

The permission you're looking for is in the Active Directory, not in the filesystem. Install the Windows Support Tools from the "\SUPPORT\TOOLS" directory on your operating system media to get ADSIEDIT installed.

Once you've got ADSIEDIT installed fire it up (w/ Start / Run / ADSIEDIT.MSC) and navigate to the "Domain", your domain's name, "System", "Policies", the GUID for the GPO where the errant software assignment is located, "Machine", "Class Store", and "Packages". There you'll find GUIDs for each package assigned in the GPO. You can use the "PackageName" attribute in the properties of each object there to locate the one that corresponds to your package with the errant permission. Once you find it, go to the "Security" tab and view the permissions. Using the "Advanced" view it's a snap to find the "not inherited" permission that corresponds to your "Authenticated Users" denial permission (probably listed as "Special"-- you can drill into the permission to see what is being denied). Remove the errant permission and you'll find that you can see the assignment in the Group Policy Editor again.

Improve this answer
0

backup the GPO and navigate to the folder location which represents where your setting was (once you've back it up you'll understand what i mean), there should be an ini or inf file, edit the file there, then restore the GPO.

Improve this answer
2
  • Thanks. It seemed as a good approach, but unfortunately does not work. On primary server there are three files in: C:\WINDOWS\SYSVOL\...\Policies\{4F57DDC6-724C-4537-9656-EF4690AD8A8D}\Machine\Applications\ {59952201-EAA2-4AFC-9A9A-BE7240F00FAC}.aas {8C5D9910-3C7C-4B94-BAD2-2A3C066AAB69}.aas ADE.CFG second one (starting 8C5..) is the disappeared package - this file backuped GPO doesn't contain at all. I am in fear that this hidden package is living it's own live in GPO, out of control. Any idea how to find it?
    – sirka
    Oct 30, 2009 at 12:34
  • open GPMC.MSC (Download from Microsoft microsoft.com/downloads/…) you should see the GPO there. Click the delegation tab remove authenticated users from the list of groups and users. you should then have control of your GPO.
    – Nasa
    Nov 5, 2009 at 9:49

You must log in to answer this question.