none
Error Message: This Operation Has Been Cancelled Due to Restrictions in Effect on This Computer

    Question

  • I have 3 users locked down using the "Run only specified Windows applications" GPO.  I am having a problem with one of them.  He gets the error "This Operation Has Been Cancelled Due to Restrictions in Effect on This Computer" when trying to launch some applications that are in the allowed list.  Others in the list work fine.  I see that the lockdown policy was applied in GPRESULT.

    The only thing different with this user account is I had changed his name using the RENAME option in ADUC.  When you do that, the local profile on the PC retains the original name but everything is supposed to work correctly.  I had renamed the account before I added him to the Lockdown group.  It still confuses me why some of the apps in the white list work.  Anyone know a fix?

    Wednesday, July 18, 2012 1:40 PM

Answers

  • Hi,

    I agree with Martin, he has provided a good suggestion on the current issue. At this time, we could try to add the following exe and dll files to the list to check if it can resolve the issue.

    LaunchApp.exe

    MyAppName.exe

    MyAppName.exe.application

    MyAppName.exe.deploy

    MyAppName.exe.manifest

    MyAppName.vshost.exe

    dfsvc.exe

    dfsvc.ni.exe

    AppLaunch.exe

    rundll32.exe

    dfshim.dll

    dfdll.dll

    If the issue persist, please download and run Process Monitor to monitor the cause of the issue. We could download the tool in the following link.

    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

    Regards,

    Andy

    Thursday, July 19, 2012 8:13 AM
  •  
    > The applications that fail for this user work correctly for the other
    > two users.  All users are in the same Security Group and have the same
    > lockdown policy with the same exceptions applied.
     
    So what? Remove the lockdown policy and track down what processes are
    started.
     
    Alternately, you may delete the user profile - sometimes the SRP
    registry keys get messed up.
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Thursday, July 19, 2012 1:09 PM

All replies

  • Remove the lockdown policy, use process monitor and process explorer to
    track down which sub-processes the application in question starts...
    Sometimes it's a call to rundll32.exe, but you have to find it out on
    your own.
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Wednesday, July 18, 2012 7:48 PM
  • Hi,

    I agree with Martin, he has provided a good suggestion on the current issue. At this time, we could try to add the following exe and dll files to the list to check if it can resolve the issue.

    LaunchApp.exe

    MyAppName.exe

    MyAppName.exe.application

    MyAppName.exe.deploy

    MyAppName.exe.manifest

    MyAppName.vshost.exe

    dfsvc.exe

    dfsvc.ni.exe

    AppLaunch.exe

    rundll32.exe

    dfshim.dll

    dfdll.dll

    If the issue persist, please download and run Process Monitor to monitor the cause of the issue. We could download the tool in the following link.

    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

    Regards,

    Andy

    Thursday, July 19, 2012 8:13 AM
  • The applications that fail for this user work correctly for the other two users.  All users are in the same Security Group and have the same lockdown policy with the same exceptions applied.
    Thursday, July 19, 2012 12:11 PM
  •  
    > The applications that fail for this user work correctly for the other
    > two users.  All users are in the same Security Group and have the same
    > lockdown policy with the same exceptions applied.
     
    So what? Remove the lockdown policy and track down what processes are
    started.
     
    Alternately, you may delete the user profile - sometimes the SRP
    registry keys get messed up.
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Thursday, July 19, 2012 1:09 PM