Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Windows 7 64-bit and have configured Software Restriction Policies so that "Disallowed" is the default security level. I also have Path Rules defined so that software in C:\Program Files, C:\Program Files (x86), and C:\Windows can execute. I also want it to apply to only my limited user account, so it is configured for "All users except local administrators".

But it is still affecting my admin account. When I'm logged in as my admin user and I try to run any executable file in the C:\Users\admin\Downloads directory, I get a popup saying "This program is blocked by group policy."

Any idea why it is affecting my admin account even though it is set to "All users except local administrators"?

share|improve this question
1  
I would guess that "all users except local administrators" actually means "all users except local administrators running in an elevated context". What happens if you right-click on an executable and say "run as administrator"? –  Harry Johnston Jan 20 '13 at 21:06
    
Harry you are right, that is the issue. Executable files in C:\Users\admin\Downloads run fine if I do "Run as administrator". –  pacoverflow Jan 21 '13 at 6:18
add comment

1 Answer

I´m not sure I 100% understand your question but after a similar one I found an explanation in the sevenforums discussion.

"administrator user - Is an unelevated administrator account that is created by default during the installation of Windows 7, or is already setup or you on a OEM (ex: Dell) computer. An administrator account has complete access to the computer, and can make any desired changes. To help make the computer more secure, this administrator account type will be prompted by UAC by default to give confirmation before allowed to make any changes that require elevated administrator rights. Such as those that affect the system, other users, or when running anything elevated (Run as Administrator) since running elevated will allow it to have access to the entire computer. Built-in "Administrator" - Is the hidden elevated administrator account that has full unrestricted access rights and permission on the computer. By default, this elevated "Administrator" account is not prompted by UAC by default to provide confirmation before allowed to make any changes that require elevated administrator permissions since it is an elevated account."

Hope that helps

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.