I've set up several Software Restriction Policies (SRPs) for executable files located in the same directory. Each executable has its own Group Policy Object (GPO) for user requests for access, allowing users to be excluded from the policy if needed. The issue I'm facing is that only two of these restriction policies are functioning correctly. Three other executable files are still executable despite the corresponding GPOs being deployed and showing as applied. Additionally, there's no registry key created under HKCUSoftwarePoliciesMicrosoftWindowsSaferCodeIdentifiers for those files. All of my GPOs are configured similarly, and the restrictions are set as user configuration. Does anyone have an idea why only two of them are working?
2 Answers
Consider looking into App Locker as a replacement for Software Restriction Policies since SRP is getting phased out. It might provide a more robust solution for managing executable permissions.
I'd recommend starting by running gpresult to check what policies are actually being applied to your users. It can give you a clear picture of the active settings on their machines.
I ran gpresult and it shows all policies as applied.
I agree with you there. If I had the choice, I'd definitely prefer using App Locker or WDAC over SRP.