Software restriction policies

In Windows XP Professional, software restriction policies allow you to control the ability of software to run on your local computer.

  • Before implementing software restriction policies, see Checklist: Steps to help protect your computer against an e-mail virus.
  • For tips about using software restriction policies, see Best practices.
  • For help with specific tasks, see How to...
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Always test policy on a test computer before applying it to any other computers.

  • Do not apply rules at the Disallow level without the proper testing. Restrictions on certain files can seriously affect the operation of your computer or network.

Software restriction policies should not be used as a replacement for anti-virus software.

Use software restriction policies in conjunction with access control settings.

  • For more information, see Access Control.

Prepare carefully if using Disallowed as the default setting

  • Many applications start other applications to perform certain tasks. You should ensure that all major tasks in your applications are covered by your rules.
  • If your computer needs to run logon scripts, make sure you have created a path rule that allows for them to run.

    For information on how precedence works on path rules, see Precedence of software restriction policies.

  • Check the Startup folder on your computer and ensure those programs are allowed to run.
  • You can also find startup items in the registry:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  • You can create a Disallowed rule for:

    %windir%\system32\dllcache

    A copy of a program you may have disallowed may exist here, giving that program the ability to run.


Checklist: Steps to help protect your computer against an e-mail virus

Step | Reference
Review best practices | Best practices
Create a path rule for all the folders that your mail program uses to run e-mail attachments and set the security level to Disallowed. | To identify files through a path rule
Specify which file types the rule will apply to. | To add or delete a designated file type


How to..

Microsoft Windows graphic

How to...

  • Start software restriction policies
  • Create a certificate rule
  • Create a hash rule
  • Create a hash rule to prevent known viruses from running
  • Create an Internet zone rule
  • Identify files through a path rule
  • Add or delete a designated file type
  • Change the default level of software restriction policies
  • Set trusted publisher options
  • Prevent software restriction policies from applying to local administrators


Start Security Restriction Policies

To start software restriction policies

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies

Note

  • XOX

Related Topics


Create a certificate rule

To create a certificate rule

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. Right-click Additional Rules and then click New Certificate Rule.
  4. Click Browse, click the appropriate certificate, and click Open.
  5. Select the Security Level.
  6. (Optional) Enter a description for this rule and click OK.

Notes

  • XOX
  • The only file types affected by certificate rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
  • Certificate rules do not apply to files with .exe or .dll extensions. They can be applied to scripts and Windows installer packages.
  • To refresh software restriction policies, you must log off of and then log back on to your computer.
  • For more information on your options for enforcing software restriction policies, see Related Topics.
  • When more than one rule is applied to policy, there is a precedence of rules for handling conflicts. For more information, see Precedence of software restriction policies.

Related Topics


Create a hash rule

To create a hash rule

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. Right-click Additional Rules and click New Hash Rule.
  4. Choose either a file or hash.
    • For a file, click Browse and click the file you would like to create a rule for.
    • For a hash, if you have calculated a hash value elsewhere using software restriction policies, paste the hash in File hash.
  5. Click the desired Security Level.
  6. (Optional) Enter a description for this rule.

Notes

  • XOX
  • The only file types affected by hash rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
  • If you use a hash rule to identify a virus, be aware that any change to the file that contains the virus will affect the hash value.
  • If you would like others to use a hash rule so that a virus cannot run, you should calculate the hash of the virus using software restriction policies and e-mail the hash value to others. Never e-mail the virus itself.
  • A file that is renamed or moved to another folder will still result in the same hash.
  • To refresh software restriction policies, you must log off of and then log on to your computer.
  • When more than one rule is applied to policy, there is a precedence of rules for handling conflicts. For more information see, Precedence of software restriction policies.

Related Topics


Create a hash rule to prevent a known virus from running

To create a hash rule to prevent a known virus from running

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. Right-click Additional Rules and click New Hash Rule.
  4. Choose either a file or hash.
    • For a file, click Browse and click the file you would like to create a rule for. Software restriction policies automatically hashes the file you choose.
    • For a hash, if you have calculated a hash value elsewhere using software restriction policies, paste the hash in File hash.
  5. In Security Level, click Disallowed to prevent the file from executing.
  6. Type a description for this rule and click OK.

Important

  • Software restriction policies should not be used as a replacement for anti-virus software.

Notes

  • XOX
  • This procedure can be used for a virus, Trojan horse, or any file you do not want to run on your computer.
  • If the virus has been sent through e-mail, you can also create a path rule to prevent execution of mail attachments. For more information, see To identify files through a path rule.

Related Topics


Create an Internet zone rule

To create an Internet zone rule

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. Right-click Additional Rules and click New Internet Zone Rule
  4. Click an Internet zone.
  5. Click the appropriate Security Level.

Notes

  • XOX
  • Zone rules apply only to Windows installer packages.
  • The only file types affected by zone rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
  • To refresh software restriction policies, log off of and then log on to your computer.
  • When more than one rule is applied to policy, there is a precedence of rules for handling conflicts. For more information, see Precedence of software restriction policies.

Related Topics


Identify files through a path rule

To identify files through a path rule

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. Right-click Additional Rules and click New Path Rule.
  4. In Path field, type a path or browse to a file or folder.
  5. Select a Security Level.
  6. In Description, type a description for this rule and click OK.

Important

  • On certain folders, such as the Windows folder, setting the security level to Disallowed can adversely affect the operation of your operating system.

Notes

  • XOX
  • To refresh software restriction policies, you must log off and then log on to your computer.
  • The only file types affected by path rules are those that are listed in Designated file types. There is one list of designated file types that is shared by all rules.
  • If you create a path rule for a program with a security level of Disallowed, a user can still run the software by simply copying it to another location.
  • You can use environment variables such as %programfiles% or %systemroot% in your path rule.
  • The wildcard characters that are supported by the path rule are * and ?.
  • If you would like to prevent users from executing mail attachments, you can create a path rule for your mail program's attachment directory that prevents users from running mail attachments.
  • When more than one rule is applied to policy, there is a precedence of rules for handling conflicts. For more information, see Precedence of software restriction policies
  • For more information, see To add or delete a designated file type.

Related Topics


Add or delete a file type

To add or delete a designated file type

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. In the details pane, double-click Designated File Types.
  4. Do one of the following:
    • To add a file type, enter the file name extension in the File extension field and click Add.
    • To delete a file type, click the file type entry in the Designated file types list and then click Delete.

Notes

  • XOX
  • The Designated file types list is shared by all rules.

Related Topics


Change the default level of software restriction policies

To change the default level of software restriction policies

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. In the details pane, double-click Security Levels.
  4. Right-click the level you would like to set as the default and click Set as default.

Caution

  • In certain directories, setting the security level to Disallowed can adversely affect your operating system.

Notes

  • XOX
  • In the details pane, the current default level is indicated by a black circle with a check mark in it. If you right-click the current default level, Set as default does not appear in the menu.
  • Changing the default level will affect all files on the computers that have software restriction policies applied to them.
  • Upon installation, the default security level of software restriction policies on all files on your system is set to Unrestricted.
  • If the default level is set to Unrestricted, you can identify and create rules for the set of programs you would like to prohibit from running.
  • If the default level is set to Disallowed, you can identify and create rule exceptions for the programs you trust to run.

For more information, see Best practices.


Set trusted publisher options

To set trusted publisher options

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. In the details pane, double-click Trusted Publishers.
  4. Click the group that should have the right to decide what certificates will be trusted.
  5. (Optional) To have software restriction policies check to see if a certificate is revoked, select the appropriate Publisher and Timestamp check boxes.

Notes

  • You can choose who can add trusted publishers from End users, Local computer administrators, or Enterprise administrators. For example, you can use this tool to prevent users from making trust decisions about publishers of ActiveX controls.
  • Local computer administrators have the right to specify trusted publishers on the local computer, while enterprise administrators have the right to specify trusted publishers on an organizational unit level.
  • XOX
  • For more information, see Software restriction policies.


Prevent software restriction policies from applying to local administrators

To prevent software restriction policies from applying to local administrators

  1. Open Local Security Settings.
  2. In the console tree, click Software Restriction Policies.

    3. Where?

    • Security Settings
    • Software Restriction Policies
  3. In the details pane, double-click Enforcement.
  4. Under Apply software restriction policies to the following users, click All users except local administrators.

Notes

  • XOX
  • For more information, see Software restriction policies.


Concepts

  • Software restriction policies overview
  • Additional rules and security levels
  • Precedence of software restriction policies


Software restriction policies overview

With software restriction policies, you can protect your computer environment from untrusted code by identifying and specifying which applications are allowed to run. The applications can be identified in policy through a hash rule, a certificate rule, a path rule, or an Internet zone rule. The software can run on two levels: unrestricted and disallowed. (For information on how to create these rules, see To create a hash rule, To create a certificate rule, To identify files through a path rule, and To create an Internet zone rule.)

Software restriction policies confront the problem of regulating unknown or untrusted code. A business uses a set of programs that they know and trust. Administrators and help desk personnel are trained in supporting these programs. However, once users begin running other programs, these programs may conflict with other installed programs, change crucial configuration data, or worse—they may contain a virus or Trojan horse.

With the rise in the usage of networks, the Internet, and e-mail for business computing, users find themselves exposed to programs in a variety of ways, shapes, and forms. Users are constantly confronted with making decisions about running unknown code because documents and Web pages contain executable code due to the scripts they contain. Viruses and Trojan horses often intentionally misrepresent themselves to trick users into running them. With the sheer number and variety of programs, it becomes very difficult for individual users to make effective choices about what software they should run.

Users need a more powerful way to identify software so that it can be classified as trusted or untrusted. Once programs are identified, one can apply a policy to classify whether they should be allowed to run. Software restriction policies provide a number of ways to identify software and a policy-based infrastructure to enforce decisions about whether the software can run.


Additional rules and security levels

When you apply software restriction policies, you identify the software through these rules:

Certificate rule

Software restriction policies can identify a file by its signing certificate. Certificate rules do not apply to files with .exe or .dll extensions. They can be applied to scripts and Windows installer packages. You can create a certificate rule which identifies software and then, depending on the security level, allows or does not allow it to run. For example, an administrator can use certificate rules to automatically trust software from a trusted source in a domain without prompting the user. You can also use certificate rules to run files in disallowed areas of your operating system.

For more information, see To create a certificate rule.

Path rule

A path rule identifies programs by their file path. For example, if you have a computer that has a Disallowed default policy, you can still grant unrestricted access to a specific folder for each user. Some common paths for this type of rule would be %userprofile%, %windir%, %appdata%, %programfiles%, and %temp%.

Since these rules are specified by path, if a program is moved, then the path rule will no longer apply.

For more information, see To identify files through a path rule.

Hash rule

A hash is a series of bytes with a fixed length that uniquely identifies a program or file. The hash is computed by a hash algorithm. Software restriction policies can identify files by their hash, using both the SHA-1 (Secure Hash Algorithm) and the MD5 hash algorithm.

For example, you can create a hash rule and set the security level to Disallow to prevent users from running a certain file. A file can be renamed or moved to another folder and still result in the same hash. However, any tampering with the file will change its hash value and allow it to bypass restrictions.

Software restriction policies will only recognize hashes that have been calculated using software restriction policies.

For more information, see To create a hash rule.

Internet zone rule

Zone rules only apply to Windows Installer packages. (For more information, see Windows Installer overview.)

A zone rule can identify software from the zone that is specified through Internet Explorer. These zones are Internet, Local computer, Local Intranet, Restricted Sites, and Trusted Sites.

For more information, see To create an Internet zone rule.

Security level

For software restriction policies, the security levels are:

  • Unrestricted, which allows software to run with the full rights of the user who is logged in.
  • Disallowed, which does not allow the software to run.


Precedence of software restriction policies

A specific program can have several different rules applied to it. Because of this, these rules are applied in the following order of precedence. They are listed from highest precedence to lowest precedence:

  1. Hash rule.
  2. Certificate rule.
  3. Path rule. When there are conflicting path rules, the most restrictive rule takes precedence. The following is a set of paths, from highest precedence (most restrictive) to lowest precedence (least restrictive).
    • Drive:\Folder1\Folder2\FileName.Extension
    • Drive:\Folder1\Folder2\*.Extension
    • *.Extension
    • Drive:\Folder1\Folder2\
    • Drive:\Folder1\
  4. Internet zone rule.

Application of precedence

For example, if you have a file whose hash is unrestricted but resides in a folder whose path rule is set to Disallowed, the file will run, since the hash rule has precedence over the path rule.

If there are two similar rules, the more restrictive rule takes precedence. For example, if there is a path rule for C:\Windows\ with a security level of Disallowed and there is a path rule for %windir% with a security level of Unrestricted, then the more restrictive rule is used, which is Disallowed.

Related Topics


Troubleshooting

What problem are you having?

Users get an error message which says "Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator."

Cause: Software restriction policies

Solution: Check the event log and ask your administrator.

You can search the event log for software restriction policies events starting from a specific date. To do this, type the following at a command prompt:

eventquery -l system -fi "id ge 865" -fi "id le 868" -fi "datetime ge mm/dd/yy,12:00:00am" -v -fo list

In this command, mm is the month, dd is the day, and yy is the year of the starting date.

See also: Software restriction policies

Modified software restriction policies are not taking effect as expected.

Cause: Software restriction policies have not been refreshed.

Solution: Refresh policy by logging off of the network and then logging on to the network again.

Cause: Software restriction policies are not being applied.

Solution: Create and check the log file.

You can create a log file to review software restriction policies by editing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Add the new string value LogFileName and add a path and file name for the log file, in the following format:

volume:\path\filename.extension

For example, one valid specification would be C:\Windows\Safer.log.

For more information about adding values to registry keys, see To add a value.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

For more information, see Software restriction policies.