Solved

SRP (Software Restriction Policies) is blocking local Administrator.

Posted on 2011-02-10
4
895 Views
Last Modified: 2012-05-11
I implemented SRP on a Windows 7 Pro PC that I was logged into as the Local Administrator. In Enforcement I ensured that "All users except local administrators" was selected. I then set the default Security Level to Disallow. At this point I attempted to open Windows Update from the Start menu and was blocked. I ran gpupdate, still blocked. I rebooted the PC, still blocked. I changed the default Security Level back to Unrestricted and was no longer blocked. Why is'nt the "All users except local administrators" enforcement variable working? This is the 9th PC I've setup with SRP, all the same configuration, and all the others work fine. Any ideas?
0
Comment
Question by:tstarlin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:DarinTCH
ID: 34865845
run RSOP
resultant set of policy
to determine what is being applied
compare to working unit
0
 

Author Comment

by:tstarlin
ID: 34866338
Ran RSOP and compared a PC that the local Administrator isnt being blocked to the one that is. Went line by line. There is no difference at all.
0
 
LVL 12

Accepted Solution

by:
DarinTCH earned 250 total points
ID: 34893916
wow
that makes it a bit more difficult

here is the only other thing I have seen similiar
some laptops were on a domain and some were not
some were in a blocked OU (inheritance)
an admin made a change to the default domain policy and
checked policy enforcement
the OUs below the primary container were effected eventhough they had block inheritance set up...
the admin tried to be slick and 'turn off' the items he changed...but
after he activated a change... just choosing not applied DOES NOT UNDO the changes he made
we ended up reimaging the laptops to solve his 'unintentional changes

p.s. it took quite a while to figure this out
0
 

Author Comment

by:tstarlin
ID: 34897280
DarinTCH, I'm guessing this may be a similar situation. I'm going to reformat this PC and start from scratch. It has to be some kind of glitch. Thank you for your thoughts and take care.
0

Featured Post

Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
By default the complete memory dump option is disabled in windows . If we want to enable the complete memory dump for a diagnostic purpose, we have a solution for it. here we are using the registry method to enable this.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question