I have a set of configurations which I need to replicate from my domain joined computers to non-domain (Workgroup) joined computers. I created a GPO, enabled Loopback processing and imported them via LGPO.exe (Microsoft Security Compliance Toolkit). One of the configurations include software restriction policies. I want to restrict normal users accessing the certain file extensions, where as administrators should have full access. On the domain level, it works fine when I apply security filtering for Domain Admins. But on the Workgroup level, it doesn't. The policy gets applied for all the users, including Local Administrators.

I want to make sure that only local users are affected by the user configuration policies.

If I apply a WMI filter to exclude Built-in Local Administrators group, will it work?

Please advice. Thanks in advance.

1 Answer 1


Is there any specific reason why you are not using "Enforcement" under "Software Restriction Policies"?

Computer Configuration \ Policies \ Windows Settings \ Security \ Software Restriction Policies \ Enforcement

enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.