Software Restriction Policy

[mike Dower]

I have a PC on our network that has recently been removed
from the domain. When the machine was attached to the
domain it was subject to a Software Restriction policy
(SRP) which was set through a GPO on the Domain.

The problem I have is that even though I have removed the
Computer from the domain, the SRP is still effective and
preventing me form opening certain software.

Does anyone know how to remove this Policy, without
formatting and re-stalling XP?

Many Thanks - Mike.

 

[Doug Knox MS-MVP]

You can try removing it locally via GPEDIT.MSC

 

[Guest]

I've tried that already.

When I open gpedit.msc it opens the Local Computer
Policy, and there is no Software Restriction Policy
defined within this!!

 

[Paul Adare]

microsoft.public.windowsxp.security_admin news group, mike Dower

The problem I have is that even though I have removed the
Computer from the domain, the SRP is still effective and
preventing me form opening certain software.

Does anyone know how to remove this Policy, without
formatting and re-stalling XP?

You'll need to rejoin it to the domain, then configure a GPO that
disables (disables, not "not configured") SRP for this computer. Make
sure the policy has been applied, and then remove it from the domain
again. Failing that, you'll need to reinstall.

 

[Mike Dower]

When you say set a new GPO to Disable Software
Restriction Policy, do you mean set the Default level
to 'Unrestricted' on the new Software Restricion Policy?

Mike.

-----Original Message-----

 

[Paul Adare]

microsoft.public.windowsxp.security_admin news group, Mike Dower

When you say set a new GPO to Disable Software
Restriction Policy, do you mean set the Default level
to 'Unrestricted' on the new Software Restricion Policy?

Yeah, you need to reverse whatever changes you've made via GP, and then
remove the system from the domain.

Note that there are other security related settings in GP that "tattoo"
the registry as well. You may be better of reinstalling the OS.

 

[Steven L Umbach]

This may or may not work but try to configure a policy - any obscure policy
such as a hash rule for an executable and then reboot the computer to see if
it helps. Make sure that the computer knows it is no longer a member of a
domain and belongs to a workgroup. --- Steve

 

[Paul Adare]

microsoft.public.windowsxp.security_admin news group, Steven L Umbach

This may or may not work but try to configure a policy - any obscure policy
such as a hash rule for an executable and then reboot the computer to see if
it helps. Make sure that the computer knows it is no longer a member of a
domain and belongs to a workgroup. --- Steve

You can't use software restriction policies unless the box is a domain
member.

 

[Steven L Umbach]

Hi Paul. I have been able to successfuly use it via Local Security
Policy/machine configuration on a stand alone XP Pro machine and use it to
restrict all users but the administrators via the enforcement rule. ---
Steve

 

[Paul Adare]

microsoft.public.windowsxp.security_admin news group, Steven L Umbach

Hi Paul. I have been able to successfuly use it via Local Security
Policy/machine configuration on a stand alone XP Pro machine and use it to
restrict all users but the administrators via the enforcement rule. ---
Steve

Doh! Sorry, brain fart. Thanks for being gentle Steven.