Software restriction policies

You can use software restriction policies to identify software and to control its ability to run on your local computer, organizational unit, domain, or site.

  • Before implementing software restriction policies to prevent an e-mail virus from running on your computer, see Checklist: Using software restriction policies to help protect your computer against an e-mail virus.
  • For tips about using software restriction policies, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Using software restriction policies to help protect your computer against an e-mail virus

Step | Reference
Review best practices for software restriction policies. | Best practices
Open Software Restriction Policies. | To open Software Restriction Policies
If you have not previously defined software restriction policies, create new software restriction policies. | To create new software restriction policies
Create a path rule for the folder that your e-mail program uses to run e-mail attachments, and then set the security level to Disallowed. | To create a path rule
Specify the file types to which the rule applies. | To add or delete a designated file type
Modify policy settings so that they apply to the users and groups that you want:
  • Specify users or groups to which you do not want the Group Policy object's (GPO) policy settings to apply.
  • Exclude local administrators from the software restriction policies of a specific policy setting in Group Policy and still have the rest of Group Policy apply to the administrators.
Group Policy; To prevent software restriction policies from applying to local administrators


Best practices

Do not modify the default domain policy.

  • If you do not edit the default domain policy, you always have the option of reapplying the default domain policy if something goes wrong with your customized domain policy.

Create a separate Group Policy object for software restriction policies.

  • If you create a separate Group Policy object (GPO) for software restriction policies, you can disable software restriction policies in an emergency without disabling the rest of your domain policy.

    • For more information, see Group Policy.

If you experience problems with applied policy settings, restart Windows in Safe Mode.

  • Software restriction policies do not apply when Windows is started in Safe Mode. If you accidentally lock down a workstation with software restriction policies, restart the computer in Safe Mode, log on as a local administrator, modify the policy, run gpupdate, restart the computer, and then log on normally.

    For more information about restarting the computer in Safe Mode, see To start the computer in Safe Mode. For more information about gpupdate, see Gpupdate.

Use caution when defining a default setting of Disallowed.

  • When you define a default setting of Disallowed, all software is disallowed except for software that has been explicitly allowed. Any file that you want to open has to have a software restriction policies rule that allows it to open.
  • To protect administrators from locking themselves out of the system, when the default security level is set to Disallowed, four registry path rules are automatically created. You can delete or modify these registry path rules; however, this is not recommended.

    • For more information, see Setting the default security level to Disallowed.

For best security, use access control lists in conjunction with software restriction policies.

  • Users might try to circumvent software restriction policies by renaming or moving disallowed files or by overwriting unrestricted files. As a result, it is recommended that you use access control lists (ACLs) to deny users the access necessary to perform these tasks. For information about access control, see Access control.

Test new policy settings thoroughly in test environments before applying the policy settings to your domain.

  • New policy settings might act differently than originally expected. Testing diminishes the chance of encountering a problem when you deploy policy settings across your network.
  • You can set up a test domain, separate from your organization's domain, in which to test new policy settings. You can also test the policy settings by creating a test GPO and linking it to a test organizational unit. When you have thoroughly tested the policy settings with test users, you can link the test GPO to your domain.
  • Do not set programs or files to Disallowed without testing to see what the effect may be. Restrictions on certain files can seriously affect the operation of your computer or network.
  • Information that is entered incorrectly or typing mistakes can result in a policy setting that does not perform as expected. Testing new policy settings before applying them can prevent unexpected behavior.

Filter user policy settings based on membership in security groups.

  • You can specify users or groups for which you do not want a policy setting to apply by clearing the Apply Group Policy and Read check boxes, which are located on the Security tab of the properties dialog box for the GPO.
  • When the Read permission is denied, the policy setting is not downloaded by the computer. As a result, less bandwidth is consumed by downloading unnecessary policy settings, which enables the network to function more quickly. To deny the Read permission, select Deny for the Read check box, which is located on the Security tab of the properties dialog box for the GPO.

    For more information, see Group Policy.

Do not link to a GPO in another domain or site.

  • Linking to a GPO in another domain or site can result in poor performance.


How to...

  • Create new software restriction policies
  • Open Software Restriction Policies
  • Apply software restriction policies to DLLs
  • Prevent software restriction policies from applying to local administrators
  • Enable certificate rules
  • Create a certificate rule
  • Create a hash rule
  • Create an Internet zone rule
  • Create a path rule
  • Create a registry path rule
  • Add or delete a designated file type
  • Change the default security level of software restriction policies
  • Set trusted publisher options


Create new software restriction policies

Microsoft Windows Graphic

To create new software restriction policies

  1. Open Software Restriction Policies.
  2. On the Action menu, click New Software Restriction Policies.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create new software restriction policies for your local computer: XOX
    • If you create new software restriction policies for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • If software restriction policies have already been created for a Group Policy object (GPO), the New Software Restriction Policies command does not appear on the Action menu. To delete the software restriction policies that are applied to a GPO, in the console tree, right-click Software Restriction Policies, and then click Delete Software Restriction Policies. When you delete software restriction policies for a GPO, you also delete all software restriction policies rules for that GPO. After you delete software restriction policies, you can create new software restriction policies for that GPO.

Related Topics


Open Software Restriction Policies

Microsoft Windows graphic

To open Software Restriction Policies

For your local computer

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies

Notes

  • XOX
  • XOX

For a domain, site, or organizational unit, and you are on a member server or on a workstation that is joined to a domain

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. In Select Group Policy Object, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit—or create a new one, and then click Finish.
  6. Click Close, and then click OK.
  7. In the console tree, click Software Restriction Policies.

    8. Where?

    • Group Policy Object [ComputerName] Policy
    • Computer Configuration or
      User Configuration
    • Windows Settings
    • Security Settings
    • Software Restriction Policies

Notes

  • XOX
  • XOX

For a domain or organizational unit, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the Group Policy object (GPO) that you want to open software restriction policies for.
  3. Click Properties, and then click the Group Policy tab.
  4. Click Edit to open the GPO that you want to edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Software Restriction Policies.

    6. Where?

    • Group Policy Object [ComputerName] Policy
    • Computer Configuration or
      User Configuration
    • Windows Settings
    • Security Settings
    • Software Restriction Policies

Notes

  • XOX
  • XOX

For a site, and you are on a domain controller or on a workstation that has the Administration Tools Pack installed

  1. Open Active Directory Sites and Services.
  2. In the console tree, right-click the site that you want to set Group Policy for.

    Where?

    • Active Directory Sites and Services [Domain_Controller_Name.Domain_Name]
    • Sites
    • Site
  3. Click Properties, and then click the Group Policy tab.
  4. Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Software Restriction Policies.

    6. Where?

    • Group Policy Object [ComputerName] Policy
    • Computer Configuration or
      User Configuration
    • Windows Settings
    • Security Settings
    • Software Restriction Policies

Notes

  • XOX
  • XOX

Notes

  • To set policy settings that will be applied to computers, regardless of which users log on to them, click Computer Configuration.
  • To set policy settings that will be applied to users, regardless of which computer they log on to, click User Configuration.


Apply software restriction policies to DLLs

Microsoft Windows Graphic

To apply software restriction policies to DLLs

  1. Open Software Restriction Policies.
  2. In the details pane, double-click Enforcement.
  3. Under Apply software restriction policies to the following, click All software files.

Notes

  • XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • By default, software restriction policies do not check dynamic-link libraries (DLLs). Checking DLLs can decrease system performance, because software restriction policies must be evaluated every time a DLL is loaded. However, you may decide to check DLLs if you are concerned about receiving a virus that targets DLLs. If the default security level is set to Disallowed, and you enable DLL checking, you must create software restriction policies rules that allow each DLL to run. For more information about rules, see Related Topics.


Prevent software restriction policies from applying to local administrators

Microsoft Windows Graphic

To prevent software restriction policies from applying to local administrators

  1. Open Software Restriction Policies.
  2. In the details pane, double-click Enforcement.
  3. Under Apply software restriction policies to the following users, click All users except local administrators.

Notes

  • XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • If it is common for users to be members of the local Administrators group on their computers in your organization, you may not want to enable this option.
  • If you are defining a software restriction policy setting for your local computer, use this procedure to prevent local administrators from having software restriction policies applied to them. If you are defining a software restriction policy setting for your network, filter user policy settings based on membership in security groups through Group Policy. For more information about Group Policy, see Related Topics.


Enable certificate rules

Microsoft Windows Graphic

To enable certificate rules

For your local computer

  1. Open Local Security Settings.
  2. In the console tree, click Security Options.

    Where?

    • Security Settings
    • Local Policies
    • Security Options
  3. In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
  4. Do one of the following, and then click OK:
    • To enable certificate rules, click Enabled.
    • To disable certificate rules, click Disabled.

Notes

  • XOX
  • XOX

For a Group Policy object, and you are on a server that is joined to a domain

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove snap-in, and then click Add.
  3. Click Group Policy Object Editor, and then click Add.
  4. In Select Group Policy Object, click Browse.
  5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit—or create a new one, and then click Finish.
  6. Click Close, and then click OK.
  7. In the console tree, click Security Options.

    8. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Security Options
  8. In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
  9. If this policy setting has not yet been defined, select the Define these policy settings check box.
  10. Do one of the following, and then click OK:
    • To enable certificate rules, click Enabled.
    • To disable certificate rules, click Disabled.

Notes

  • XOX
  • XOX

For a Group Policy object, and you are on a domain controller or a on workstation that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the Group Policy object (GPO) for which you want to enable certificate rules.
  3. Click Properties, and then click the Group Policy tab.
  4. Click Edit to open the GPO that you want to edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Security Options.

    6. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Security Options
  6. In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
  7. If this policy setting has not yet been defined, select the Define these policy settings check box.
  8. Do one of the following, and then click OK:
    • To enable certificate rules, click Enabled.
    • To disable certificate rules, click Disabled.

Notes

  • XOX
  • XOX

For only domain controllers, and you are on a domain controller or on a workstation that has the Administration Tools Pack installed

  1. Open Domain Controller Security Settings.
  2. In the console tree, click Security Options.

    3. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Security Options
  3. In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
  4. If this policy setting has not yet been defined, select the Define these policy settings check box.
  5. Do one of the following, and then click OK:
    • To enable certificate rules, click Enabled.
    • To disable certificate rules, click Disabled.

Notes

  • XOX
  • XOX

Note

  • You must perform this procedure before certificate rules can take effect.


Create a certificate rule

Microsoft Windows graphic

To create a certificate rule

  1. Open Software Restriction Policies.
  2. In either the console tree or the details pane, right-click Additional Rules, and then click New Certificate Rule.
  3. Click Browse, and then select a certificate or signed file.
  4. In Security level, click either Disallowed or Unrestricted.
  5. In Description, type a description for this rule, and then click OK.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create a certificate rule for your local computer: XOX
    • If you create a certificate rule for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It might be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • Certificate rules are not enabled by default. For information about how to enable certificate rules, see "Enable certificate rules" in Related Topics.
  • The only file types that are affected by certificate rules are those that are listed in Designated file types in the details pane for Software Restriction Policies. There is one list of designated file types that is shared by all rules. For more information, see "Add or delete a designated file type" in Related Topics.
  • For software restriction policies to take effect, users must update policy settings by logging off from and logging on to their computers.
  • When more than one software restriction policies rule is applied to policy settings, there is a precedence of rules for handling conflicts. For more information, see "Precedence of software restriction policies" in Related Topics.


Create a hash rule

Microsoft Windows graphic

To create a hash rule

  1. Open Software Restriction Policies.
  2. In either the console tree or the details pane, right-click Additional Rules, and then click New Hash Rule.
  3. Click Browse to find a file, or paste a precalculated hash in File hash.
  4. In Security level, click either Disallowed or Unrestricted.
  5. In Description, type a description for this rule, and then click OK.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create a hash rule on your local computer: XOX
    • If you create a hash rule on a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • A hash rule can be created for a virus or a Trojan horse to prevent them from running.
  • If you want other people to use a hash rule so that a virus cannot run, calculate the hash of the virus by using software restriction policies, and then e-mail the hash value to the other people. Never e-mail the virus itself.
  • If a virus has been sent through e-mail, you can also create a path rule to prevent execution of e-mail attachments. For more information, see "Create a path rule" in Related Topics.
  • A file that is renamed or moved to another folder results in the same hash. Any change to the file itself results in a different hash.
  • The only file types that are affected by hash rules are those that are listed in Designated File Types in the details pane for Software Restriction Policies. There is one list of designated file types that is shared by all rules. For more information, see "Add or delete a designated file type" in Related Topics.
  • For software restriction policies to take effect, users must update policy settings by logging off from and logging on to their computers.
  • When more than one software restriction policies rule is applied to policy settings, there is a precedence of rules for handling conflicts. For more information see, "Precedence of software restriction policies" in Related Topics.


Create an Internet zone rule

Microsoft Windows graphic

To create an Internet zone rule

  1. Open Software Restriction Policies.
  2. In either the console tree or the details pane, right-click Additional Rules, and then click New Internet Zone Rule.
  3. In Internet zone, click an Internet zone.
  4. In Security level, click either Disallowed or Unrestricted, and then click OK.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create an Internet zone rule for your local computer: XOX
    • If you create an Internet zone rule for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • Zone rules only apply to files with an .msi file type, which are Windows Installer packages.
  • For software restriction policies to take effect, users must update policy settings by logging off from and logging on to their computers.
  • When more than one software restriction policies rule is applied to policy settings, there is a precedence of rules for handling conflicts. For more information see, "Precedence of software restriction policies" in Related Topics.


Create a path rule

Microsoft Windows graphic

To create a path rule

  1. Open Software Restriction Policies.
  2. In either the console tree or the details pane, right-click Additional Rules, and then click New Path Rule.
  3. In Path, type a path, or click Browse to find a file or folder.
  4. In Security level, click either Disallowed or Unrestricted.
  5. In Description, type a description for this rule, and then click OK.

Caution

  • On certain folders, such as the Windows folder, setting the security level to Disallowed can adversely affect the operation of your operating system. Make sure that you do not disallow a crucial component of the operating system or one of its dependent programs.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create a path rule for your local computer: XOX
    • If you create a path rule for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create new software restriction policies for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • If you create a path rule for software with a security level of Disallowed, users can still run the software by copying it to another location.
  • The wildcard characters that are supported by the path rule are * and ?.
  • You can use environment variables, such as %programfiles% or %systemroot%, in the path rule.
  • If you want to create a path rule for software when you do not know where it is stored on a computer but you have its registry key, you can create a registry path rule. For more information about how to create a registry path rule, see Related Topics.
  • To prevent users from executing e-mail attachments, you can create a path rule for your e-mail program's attachment directory that prevents users from running e-mail attachments.
  • The only file types that are affected by path rules are those that are listed in Designated File Types in the details pane for Software Restriction Policies. There is one list of designated file types that is shared by all rules. For more information, see "Add or delete a designated file type" in Related Topics.
  • For software restriction policies to take effect, users must update policy settings by logging off from and logging on to their computers.
  • When more than one software restriction policies rule is applied to policy settings, there is a precedence of rules for handling conflicts. For more information, see "Precedence of software restriction policies" in Related Topics.


Create a registry path rule

Microsoft Windows Graphic

To create a registry path rule

  1. Click Start, click Run, type regedit, and then click OK.
  2. In the console tree, right-click the registry key that you want to create a rule for, and then click Copy Key Name. Note the value name in the details pane.
  3. Open Software Restriction Policies.
  4. In either the console tree or the details pane, right-click Additional Rules, and then click New Path Rule.
  5. In Path, paste the registry key name, followed by the value name.
  6. Enclose the registry path in percent signs (%), for example, %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PlatformSDK\Directories\InstallDir%.
  7. In Security level, click either Disallowed or Unrestricted.
  8. In Description, type a description for this rule, and then click OK.

Notes

  • Different administrative credentials are required to perform this procedure, depending on your environment:
    • If you create a registry path rule for your local computer: XOX
    • If you create a registry path rule for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • Format the registry path as follows: %[Registry Hive]\[Registry Key Name]\[Value Name]%
  • The name of the registry hive has to be written out; abbreviations do not work. For example, HKCU cannot be substituted for HKEY_CURRENT_USER.
  • The registry path rule can contain a suffix after the closing percent sign. Do not use a backslash (\) in the suffix. For example, %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* is valid.
  • The only file types that are affected by path rules are those that are listed in Designated File Types in the details pane for Software Restriction Policies. There is one list of designated file types that is shared by all rules. For more information, see "Add or delete a designated file type" in Related Topics.
  • To refresh software restriction policies, you must log off from and then log on to your computer.
  • When more than one software restriction policies rule is applied to policy settings, there is a precedence of rules for handling conflicts. For more information, see "Precedence of software restriction policies" in Related Topics.


Add or delete a designated file type

Microsoft Windows graphic

To add or delete a designated file type

  1. Open Software Restriction Policies.
  2. In the details pane, double-click Designated File Types.
  3. Do one of the following:
    • To add a file type, in File extension, type the file name extension, and then click Add.
    • To delete a file type, in Designated file types, click the file type, and then click Remove.

Notes

  • Different administrative credentials are required to perform this procedure, depending on the environment in which you add or delete a designated file type:
    • If you add or delete a designated file type for your local computer: XOX
    • If you add or delete a designated file type for a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • The list of designated file types is shared by all rules for both Computer Configuration and User Configuration for a GPO.


Change the default security level of software restriction policies

Microsoft Windows graphic

To change the default security level of software restriction policies

  1. Open Software Restriction Policies.
  2. In the details pane, double-click Security Levels.
  3. Right-click the security level that you want to set as the default, and then click Set as default.

Caution

  • In certain directories, setting the default security level to Disallowed can adversely affect your operating system. For more information about setting your default security setting to Disallowed, see Related Topics.

Notes

  • Different administrative credentials are required to perform this procedure, depending on the environment for which you change the default security level of software restriction policies:
    • If you change the default security level of software restriction policies on your local computer: XOX
    • If you change the default security level of software restriction policies on a computer that is joined to a domain: XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for this Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • In the details pane, the current default security level is indicated by a black circle with a check mark in it. If you right-click the current default security level, the Set as default command does not appear in the menu.
  • Software restriction policies rules are created to specify exceptions to the default security level. When the default security level is set to Unrestricted, rules can specify software that is not allowed to run. When the default security level is set to Disallowed, rules can specify software that is allowed to run.
  • At installation, the default security level of software restriction policies on all files on your system is set to Unrestricted.


Set trusted publisher options

Microsoft Windows graphic

To set trusted publisher options

  1. Open Software Restriction Policies.
  2. Double-click Trusted Publishers.
  3. Click the users that you want to decide which certificates will be trusted, and then click OK.

Notes

  • XOX
  • To open Software Restriction Policies, see "Open Software Restriction Policies" in Related Topics.
  • It may be necessary to create a new software restriction policy setting for the Group Policy object (GPO) if you have not already done so. For information about how to create new software restriction policies, see Related Topics.
  • You can use this procedure to determine whether users, local administrators, or enterprise administrators can add trusted publishers. For example, you can use this tool to prevent users from making trust decisions about publishers of ActiveX controls.
  • Local computer administrators have the right to specify trusted publishers on the local computer, while enterprise administrators have the right to specify trusted publishers on an organizational-unit level.


Concepts

This section covers:

  • Software restriction policies overview
  • Applying software restriction policies
  • Security levels and additional rules
  • Precedence of software restriction policies
  • Setting the default security level to Disallowed
  • System events for software restriction policies


Software restriction policies overview

Software restriction policies address the need to regulate unknown or untrusted software. With the rise in the use of networks, the Internet, and e-mail for business computing, users find themselves exposed to new software in a variety of ways. Users must constantly make decisions about running unknown software. Viruses and Trojan horses often intentionally misrepresent themselves to trick users into running them. It is difficult for users to make safe choices about what software they should run.

With software restriction policies, you can protect your computing environment from untrusted software by identifying and specifying what software is allowed to run. You can define a default security level of Unrestricted or Disallowed for a Group Policy object (GPO) so that software is either allowed or not allowed to run by default. You can make exceptions to this default security level by creating software restriction policies rules for specific software. For example, if the default security level is set to Disallowed, you can create rules that allow specific software to run. The types of rules are as follows:

  • Hash rules
  • Certificate rules
  • Path rules (including registry path rules)
  • Internet zone rules

For more information about each of these rules, see Security levels and additional rules.

Software restriction policies consist of the default security level and all the rules that apply to a GPO. Software restriction policies can be applied across a domain, to local computers, or to individual users. Software restriction policies provide a number of ways to identify software, and they provide a policy-based infrastructure to enforce decisions about whether the identified software can run. With software restriction policies, when users execute software programs, they must adhere to the guidelines that are set up by administrators.

With software restriction policies, you can:

  • Control the ability of software to run on your system. For example, if you are concerned about users receiving viruses through e-mail, you can apply a policy setting that does not allow certain file types to run in the e-mail attachment directory of your e-mail program.
  • Permit users to run only specific files on multiuser computers. For example, if you have multiple users on your computers, you can set up software restriction policies in such a way that users do not have access to any software except the specific files that are necessary for their work.
  • Decide who can add trusted publishers to your computer.
  • Control whether software restriction policies affect all users or just certain users on a computer.
  • Prevent any files from running on your local computer, organizational unit, site, or domain. For example, if your system has a known virus, you can use software restriction policies to stop a computer from opening the file that contains the virus.

Important

  • Software restriction policies should not be used as a replacement for antivirus software.

For more information, see:

  • Software restriction policies
  • To create a certificate rule
  • To create a hash rule
  • To create an Internet zone rule
  • To create a path rule
  • To create a registry path rule


Applying software restriction policies

Software restriction policies use rules to identify and control how software runs. You can identify a software program by its hash, certificate, or path or by the Internet zone where it resides. After the software is identified, you can decide whether or not to allow it to run. For more information, see Security levels and additional rules.

Software restriction policies can apply to computers or users, depending on whether you choose to modify settings in Computer Configuration or in User Configuration. For more information, see To open Software Restriction Policies

You apply software restriction policies through Group Policy. You apply the policy settings to a Group Policy object (GPO), which is linked to your local computer, site, domain, or organizational unit. If more than one policy setting applies, the policy settings are in the following order of precedence, from lowest to highest:

  • Local computer policy
  • Site policy
  • Domain policy
  • Organizational-unit policy

For example, for a workstation that is joined to a domain, the domain policy settings override the local security policy settings for the workstation's software restriction policies wherever there is a conflict. Likewise, if the same workstation is a member of an organizational unit, the policy settings that are applied from the organizational unit policy override both the domain policy settings and the local policy settings wherever there is a conflict. If the workstation is a member of more than one organizational unit, the organizational unit that immediately contains the workstation has the highest precedence. For more information, see Group Policy.

To check the precedence of policy when more than one GPO is applied, you can use Resultant Set of Policy (RSoP). For more information, see Resultant Set of Policy.

Each policy setting is refreshed when you restart the computer. When you modify the policy settings, they are refreshed every 90 minutes on a workstation or server and every 5 minutes on a domain controller. The policy settings are also refreshed every 16 hours, whether or not there are any changes. You can refresh policy settings by running the command-line utility gpupdate and then logging off from and logging on to your computer. For more information, see Gpupdate.


Security levels and additional rules

For software restriction policies, the security level options are:

  • Unrestricted, which allows software to run with the full rights of the user who is logged on to the computer.
  • Disallowed, which does not allow the software to run.

You can use the following rules to make exceptions to the default security level for software restriction policies. For example, if the default security level is Disallowed, you can create a path rule that makes an exception to the default security level and allows a software program to run.

More than one rule can be applied to software. When this happens, the rule with the highest precedence determines if the software will run or not run. For information about the precedence of these rules, see Precedence of software restriction policies rules.

Hash rule

A hash is a series of bytes with a fixed length that uniquely identifies a software program or file. The hash is computed by a hash algorithm. When a hash rule is created for a software program, software restriction policies calculate a hash of the program. When a user tries to open a software program, a hash of the program is compared to existing hash rules for software restriction policies. The hash of a software program is always the same, regardless of where the program is located on the computer. However, if a software program is altered in any way, its hash also changes, and it no longer matches the hash in the hash rule for software restriction policies.

For example, you can create a hash rule and set the security level to Disallowed to prevent users from running a certain file. A file can be renamed or moved to another folder and still result in the same hash. However, any changes to the file itself also change its hash value and allow the file to bypass restrictions.

For more information, see To create a hash rule.

Certificate rule

Software restriction policies can also identify software by its signing certificate. You can create a certificate rule that identifies software and then allows or does not allow the software to run, depending on the security level. For example, you can use certificate rules to automatically trust software from a trusted source in a domain without prompting the user. You can also use certificate rules to run files in disallowed areas of your operating system.

Certificate rules are not enabled by default. For information about how to enable certificate rules, see To enable certificate rules.

For information on how to create a certificate rule, see To create a certificate rule. For more information about certificates, see Certificates.

Path rule

A path rule identifies software by its file path. For example, if you have a computer that has a default security level of Disallowed, you can still grant unrestricted access to a specific folder for each user. You can create a path rule by using the file path and setting the security level of the path rule to Unrestricted. Some common paths for this type of rule are %userprofile%, %windir%, %appdata%, %programfiles%, and %temp%. You can also create registry path rules that use the registry key of the software as its path.

Because these rules are specified by the path, if a software program is moved, the path rule no longer applies.

For more information about how to create a path rule, see To create a path rule. For more information on how to create a registry path rule, see To create a registry path rule.

For information about the precedence of path rules when more than one path rule is applied to a file or folder, see Precedence of software restriction policies.

Internet zone rule

Zone rules apply only to Windows Installer packages. For more information, see Windows Installer overview.

A zone rule can identify software from a zone that is specified through Internet Explorer. These zones are Internet, Intranet, Restricted sites, Trusted sites, and My Computer.

For more information, see To create an Internet zone rule.


Precedence of software restriction policies rules

You can apply several software restriction policies rules to the same software. The rules are applied in the following order of precedence, from highest to lowest:

  • Hash rule
  • Certificate rule
  • Path rule
  • Internet zone rule

For example, if you create a hash rule with a security level of Unrestricted for a software program that resides in a folder that has a path rule assigned to it with a security level of Disallowed, the program will run. The hash rule takes precedence over the path rule.

If two path rules are assigned to the same object, the more specific rule takes precedence. For example, if there is a path rule for C:\Windows\ with a security level of Disallowed, but there is also a path rule for C:\Windows\System32\ with a security level of Unrestricted, the more specific path rule takes precedence. Software programs in C:\Windows\ will not run, but programs in C:\Windows\System32\ will run.

If two identical rules with differing security levels are applied to software, the more conservative rule takes precedence. For example, if two hash rules—one with a security level of Disallowed and one with a security level of Unrestricted—are applied to the same software program, the rule with a security level of Disallowed takes precedence, and the program will not run.

For more information, see:
  • Software restriction policies
  • To create a hash rule
  • To create a certificate rule
  • To create a path rule
  • To create an Internet zone rule


Setting the default security level to Disallowed

You can set software restriction policies so that the operating system has one of two default security levels: Unrestricted and Disallowed. When you first create software restriction policies, a default setting of Unrestricted is automatically defined. You can then apply rules that restrict the execution of specified software programs. When you set the default security level to Disallowed, most software is restricted. There are four registry path rules that are automatically created to prevent you from completely locking down your system, including locking yourself out of it. You must then apply rules for all other software that you want to run.

Software restriction policies are applied through the operating system. Certain software programs must be set to Unrestricted for the operating system to function at all. The following tips can help you decide which programs to set to Unrestricted if you decide to use a default security level of Disallowed:

  • When the default security level is set to Disallowed, four registry path rules are created automatically. They are as follows:
    • %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
    • %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%\*.exe
    • %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%\System32\*.exe
    • %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
    These registry path rules are created as a safeguard against locking yourself and all users out of the system. Only advanced users should consider modifying or deleting these rules.
  • Startup items are put in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in the registry. If you want them to run, make sure that you create a registry path rule for them. For information about creating a registry path rule, see To create a registry path rule.
  • If a computer must run logon scripts, create a path rule that allows them. For information about creating a path rule, see To create a path rule.
  • Explore your software programs when you create rules for them. Many programs start other programs to perform certain tasks. For example, Microsoft Word starts Microsoft Clip Organizer to manage clip art. For optimal performance, it is essential that all supporting programs be allowed to run.

For more information about software restriction policies, see Software restriction policies.


System events for software restriction policies

When users try to run software that has been disallowed by software restriction policies or by software restriction policies rules, events are generated and stored in the system log, as indicated in the following table. You can view these events with the Event Viewer. For more information about Event Viewer, see Event Viewer.

Event ID | What it means
865 | A user attempted to run software that is disallowed by the default security level.
866 | A user attempted to run software that is disallowed by a path rule.
867 | A user attempted to run software that is disallowed by a certificate rule.
868 | A user attempted to run software that is disallowed by an Internet zone rule or a hash rule.

For more information about the event log, see Settings for event logs. For more information about software restriction policies, see Software restriction policies.


Troubleshooting

What problem are you having?

Users receive a message that says "Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator." Or, on the command line, a message says "The system cannot execute the specified program."

Cause: The default security level (or a rule) was created so that the software program is set as Disallowed, and as a result it will not start.

Solution: Look in the event log for an in-depth description of the message. The event log message indicates what software program is set as Disallowed and what rule is applied to the program.

See also: Software restriction policies

Modified software restriction policies are not taking effect.

Cause: Software restriction policies that are specified in a domain through Group Policy override any policy settings that are configured locally. This may imply that there is a policy setting from the domain that is overriding your policy setting. For more information, see Group Policy.

Cause: Group Policy may not have refreshed its policy settings. Group Policy applies changes to policy settings periodically; therefore, it is likely that the policy changes that were made in the directory have not yet been refreshed.

Solution: You can refresh policy settings with the command-line utility gpupdate or by logging off from and then logging back on to your computer. For best results, run gpupdate, and then log off from and log back on to your computer. For more information, see Gpupdate.

XOX

Cause: The local computer on which you changed software restriction policies for the network cannot contact a domain controller.

Solution: To successfully modify policy for a network, the computer on which you modify software restriction policies must be able to contact a domain controller to update policy for the network. If the computer on which you are working cannot contact the domain controller, software restriction policies are not applied. If your computer is a member of a domain, local software restriction policies are not applied unless the computer can contact the domain controller to ensure that network policy does not override local policy.

You have added a rule to software restriction policies, and you cannot log on to your computer.

Cause: Your computer accesses many software programs and files when it starts. It is possible to inadvertently set one of these programs or files to Disallowed. Because the computer cannot access the program or file, it cannot start properly.

Solution: Start the computer in Safe Mode, log on as a local administrator, and then change software restriction policies to allow the program or file to run.

A new policy setting is not applying to a specific file name extension.

Cause: The file name extension is not in the list of designated file types for software restriction policies.

Solution: Add the file name extension to the list of supported file types.

For more information, see To add or delete a designated file type.