Open Software Restriction Policies

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To open Software Restriction Policies

• For your local computer

• For a domain, site, or organizational unit, and you are on a member server or on a workstation that is joined to a domain

• For a domain or organizational unit, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

• For a site, and you are on a domain controller or on a workstation that has the Administration Tools Pack installed

For your local computer

1. Open Local Security Settings.

2. In the console tree, click Software Restriction Policies.

   Where?

   • Security Settings/Software Restriction Policies

Notes

• To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

• To open Local Security Policy, click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Local Security Policy.

For a domain, site, or organizational unit, and you are on a member server or on a workstation that is joined to a domain

1. Open Microsoft Management Console (MMC).

2. On the File menu, click Add/Remove Snap-in, and then click Add.

3. Click Group Policy Object Editor, and then click Add.

4. In Select Group Policy Object, click Browse.

5. In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit--or create a new one, and then click Finish.

6. Click Close, and then click OK.

7. In the console tree, click Software Restriction Policies.

   Where?

   • Group Policy Object [ComputerName] Policy/Computer Configuration or

     User Configuration/Windows Settings/Security Settings/Software Restriction Policies

Notes

• To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

• To open Microsoft Management Console, click Start, click Run, type mmc, and then click OK.

For a domain or organizational unit, and you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed

1. Open Active Directory Users and Computers.

2. In the console tree, right-click the Group Policy object (GPO) that you want to open software restriction policies for.

3. Click Properties, and then click the Group Policy tab.

4. Click Edit to open the GPO that you want to edit. You can also click New to create a new GPO, and then click Edit.

5. In the console tree, click Software Restriction Policies.

   Where?

   • Group Policy Object [ComputerName] Policy/Computer Configuration or

     User Configuration/Windows Settings/Security Settings/Software Restriction Policies

Notes

• To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

• To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

For a site, and you are on a domain controller or on a workstation that has the Administration Tools Pack installed

1. Open Active Directory Sites and Services.

2. In the console tree, right-click the site that you want to set Group Policy for.

   Where?

   • Active Directory Sites and Services [Domain_Controller_Name.Domain_Name]/Sites/Site

3. Click Properties, and then click the Group Policy tab.

4. Click an entry in Group Policy Object Links to select an existing Group Policy object (GPO), and then click Edit. You can also click New to create a new GPO, and then click Edit.

5. In the console tree, click Software Restriction Policies.

   Where

   • Group Policy Object [ComputerName] Policy/Computer Configuration or

     User Configuration/Windows Settings/Security Settings/Software Restriction Policies

Notes

• To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

• To open Active Directory Sites and Services, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Sites and Services.

Notes

• To set policy settings that will be applied to computers, regardless of which users log on to them, click Computer Configuration.

• To set policy settings that will be applied to users, regardless of which computer they log on to, click User Configuration.

Information about functional differences

• Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

See Also

Concepts

Create a certificate rule
Create a hash rule
Create a path rule
Create an Internet zone rule
Software Restriction Policies
Windows Server 2003 Administration Tools Pack