"Run only allowed Windows applications"  blocks MS Office URLs

Posted on 2006-05-10
Medium Priority
Last Modified: 2013-12-04
We want users to be able to open hyperlinks from MS Office apps, including mailto: and http:.

If the Group Policy "Run only allowed Windows applications" is set (under User Config | Admin Templates | System), then users opening hyperlinks from MS Office apps (including Outlook, Word, and Excel at least), see the standerd GP restriction error:

        This operation has been canceled due to restrictions in effect on this computer.  Please contact your system administrator.

Admins are NOT blocked, and if I disable that policy, neither are users.  It affects http: and mailto: urls, at least.

I can't figure out what the problem is.  Word, Excel, Oultook, Firefox and IExplore are listed as permitted in the policy and all run fine.  As far as I know, the policy allows any executable called by a permitted executable (this must be true, or I'd see errors everywhere).

I've tried the following; nothing worked.

  * Adding every executable in the MS Office install directory to the policy's whitelist
  * Adding these files to the policy whitelist:  mshtmled.dll, hlink.dll, mshtml.dll.  Filemon showed these being accessed when a hyperlink is clicked
  * Resetting this registry key per MS kb q310049:  HKEY_Local_Machine\Software\Classes\htmlfile\shell\open\command  (though any problem there should affect all users, including admins).
  * Adding "http://www.cnn.com" to the whitelist, then trying that url from Word.

Any suggestions would be much appreciated!
Question by:IntInc

Author Comment

ID: 16650695
I should correct that first sentece (it would be nice if we could edit posts): We want to open links in the default app, whatever it is.  Our mailto handler is Outlook, for example.
LVL 51

Expert Comment

ID: 16661248
How about OLE?

Author Comment

ID: 16682482
OLE works fine.  We can link, embed and edit linked/embedded files
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.


Author Comment

ID: 17110999
For anyone's future reference, here's what we found:

The problem only occurred in the following circumstance:
    1)  The 'run only allowed windows applications' group policy was enabled
    2)  Using Microsoft Office 2003 apps (though we didn't try other versions of Office)
    3)  Firefox was the default browser

Note that Firefox worked fine outside of MS Office links.

The solution was a combination of the following:

   1)  MS Office apparently does not use the Windows shell to process hyperlinks, but uses it's own internal process.  MS KB 218153 describes how to force it to use the shell

   2)  In the registry, paths to Firefox were expressed in the short filename format (e.g. c:\progra~1\Mozill~1\...).  It wouldn't work unitl we changed it to long filenames worked.  We don't know why.  We do know that when you set Firefox as teh default browser (firefox | tools | options | ... | set as default), it changes back to the short filename.

   3) The fix in this Microsoft KB article may have been required; it was over a month ago and I don't remember if it was necessary or not:

We found the solution on our own, so we are not awarding points.
LVL 32

Expert Comment

ID: 17111844
I'll change my recommendation to PAQ/Refund.
Thanks for sharing your solution IntInc.


Accepted Solution

CetusMOD earned 0 total points
ID: 17133422
PAQed with points refunded (400)

Community Support Moderator

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Despite its rising prevalence in the business world, "the cloud" is still misunderstood. Some companies still believe common misconceptions about lack of security in cloud solutions and many misuses of cloud storage options still occur every day. …
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question