I am trying to add a certificate rule to my Software Restriction Policies to allow a signed exe.

The application I'm working with extracts an exe to the users appdata/local/temp (locked down with a path rule) with a random name and tries to execute. Its currently being blocked.

When investigating I ran rsop on a few workstations and found that no certificate rules were listed under "Additional Rules". Looking at the enforcement options, on the workstations' RSOP, I see "When applying software restriction policies:" is set to "Ignore certificate rules". This same setting is set to "Enforce certificate rules" on the domain controller. My assumption is that the workstations do not receive the cert rules if the option is set to ignore.

The "Precedence" property sheet shows that the correct policy is enabled and winning.

These certificate rules have worked in the past, however I am not the usual sysadmin so I'm not sure what may have changed.

Why would the workstations rsop show something different than what is set on the server?

  • correct, it shows ignore while looking at the RSOP.
    – Pete
    May 16 '19 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.