GPO Computer Software Restriction Policy Stopped Working

[Andy]

I have a computer restriction policy defined to certain
computers in an OU. This policy has been working for
months. This policy is marked enforced. The policy
restricts these computers from using Internet Explorer
(path rule C:\Program Files\Internet
Explorer\IEXPLORE.EXE). This week, the policy stopped
working. All of the computers in the OU can now use
Internet Explorer. I have verified that the policy has
not changed and nothing on these computers looks any
different (33 computers).

I deleted the current policy and recreated it; however
this had no effect.

 

[David Everett [MSFT]]

Hi Andy,

If you logon as the user and run rsop.msc does it show the SAFER policy is
applied with the correct configuration? If you right-click on the setting,
choose Properties and select the Precedence tab does it show the correct
policy applying the setting?

Any chance these users are Local Admins on their workstations and the
Enforcement setting in the GPO has been changed to apply the software
restriction policy to "All users except local administrators"?

Is the group policy applying according to the Application event log? Does
SceCli generate errors?

You stated, "...computer restriction policy defined to certain computers in
an OU." How did you do this? Did you remove Read and Apply Group Policy
permissions from Authenticated users and grant these rights to the specific
workstations only?