1

GOAL

Allow Users in "Students" group to execute %WINDIR%/SYSTEM32/osk.exe


ERROR

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.  

BACKGROUND

The domain configuration is highly restrictive. Although not perfect, the domain is meant to operate such that programs are enabled on a white-list basis only.


Configuration

Active Directory (AD) Configuration

  • Student Policy

    • Computer Configuration
    • Policies

      • Windows Settings
      • ...
      • Security Settings

        • ...
        • Software Restriction Policies
        • ...
        • Additional Rules
          | Name                                   | Type         | Security Level | Description | Last Modified Date      |
          |----------------------------------------+--------------+----------------+-------------+-------------------------|
          | %windir%\SYSTEM32\osk.exe | Path | Unrestricted | | 12/21/2017 10:11:58 AM |
          | %WINDIR%\SYSTEM32\OskSupport.dll Path | Unrestricted | | | 12/21/2017 10:13:13 AM |
      • ...

      • Application Control Policies

        • AppLocker
        • Executable Rules
           
          | Action | User             | Name                                  | Condition | Exceptions |
          | Deny   | EDUSRV0\Students | C:\Program Files\Windows Photo Viewer | Path      |            |
          | Allow  | EDUSRV0\Students | %windir%\System32\osk.exe             | Path      |            |
          
      • ...

      • Administrative Templates: Policy Definitions (ADMX files) retrieved from the local computer.
TEXT TOO LONG FOR HERE AND EVEN PASTEBIN!
  • User Configuration
    • Policies
      • ...
      • Windows Settings
      • Security Settings
        • Software Restriction Policies
        • Additional Rules

https://pastebin.com/raw/C4AciNXA


Screen Caps

Screen cap 1

Screen cap 2

Screen cap 3

Screen cap 4

1

You have a lot of restrictive policies configured. Sometimes it's not obvious which ones are producing the unwanted behavior.

To address this, create a separate OU that has copies of the involved GPOs, then begin removing or modifying policies until the unwanted behavior is eliminated.

Depending on how your GPOs have been built, you may be able to selectively disable them one at a time to quickly narrow down which contains the problematic settings.

Personally I like to disable all of the restrictive policies to prove to myself the problem is truly related to Group Policy, then add them back a few GPOs at a time until the problem returns.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.