locked
Block programs won't allow a program to run RRS feed

  • Question

  •  

    I edited a profile that had previously blocked Microsoft Word so it would allow Word to run. When I try to run Word, I get an error reporting that the Administrator had set a policy to prevent this action. I looked at the Event log and see the following error:

     

    Access to C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE has been restricted by your Administrator by location with policy rule {00000000-0000-0000-0000-000000000100} placed on path C:\Program Files\Microsoft Office

     

    How can I get this profile to allow Word and other Office programs to run?

     

    Background notes:

     

    1. There is another user profile on this computer that has always allowed Office programs to run and this profile responds correctly to changes in Block Programs.

     

    2. The profiles on this computer were originally created with Windows Shared Computer Toolkit and upgraded to SteadyState.

     

    3. I am not using Windows Disk Protection.

     

    4. The profiles have never been locked.

     

    Thanks.

     

    --Art

    Thursday, November 8, 2007 5:42 PM

Answers

  • Hi,

     

    You can remove this restriction manually by deleting this registry key in the user's registry hive:

     

    HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{00000000-0000-0000-0000-000000000100}

     

    -Rob

    Sunday, November 11, 2007 4:51 AM

All replies

  • Hi Art,

     

    Did this issue occur on all user accounts? You can test it within a new user account.

     

    This issue can be caused by Group Policy configuratons. Please check if you have related group policy enabled:

     

    1. Click Start and then Run.

    2. Type in gpedit.msc and click OK.

    3. Locate: Computer Configuration\Windows Settings\Security Settings\Software Restriction Policies\Additional Rules

    4. Please check if there is any Microsoft Office related rules. If there is, please delete them or change their Security Level to Unrestricted.

     

    For more information about Software Restriction Policy, please refer to the following website:

     

    Software Restriction Policy for Windows XP Clients

    http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx

     

    Best Regards,

     

    Friday, November 9, 2007 5:40 AM
  • Hi Shawn,

     

    This issue occurs only with one of the two profiles on this computer. Both profiles were created with SCT and then upgraded to SteadyState.

     

    On the profile that works, the Office programs were always permitted to run. When I block the Office programs in SteadyState, they will not run. When removed from blocking, they run again.

     

    On the profile that doesn't work, the Office programs were always blocked. Now when I remove them from blocking, they still show the error message I indicated.

     

    I looked at the policy as you indicated...it did not exist.

     

    I loaded both USER hives in the registry but don't see anything different in Office 11 security settings. Not sure if that's where things get managed anyway.

     

    My next step is to recreate the user profile from scratch unless you can point me to another solution. I can't find where the blocking policy is located.

     

    Thanks.

     

    --Art

    Friday, November 9, 2007 3:28 PM
  • Hi,

     

    You can remove this restriction manually by deleting this registry key in the user's registry hive:

     

    HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{00000000-0000-0000-0000-000000000100}

     

    -Rob

    Sunday, November 11, 2007 4:51 AM
  •  

    Thanks Rob,

     

    That solved the problem. Just curious, is this a known issue with SteadyState? It's sort of an obscure solution.

     

    Take care.

     

    --Art

    Monday, November 12, 2007 4:56 PM
  • Hi Art,

     

    According to your description, this issue can occur if related restrictions were configured, but not removed before uninstalling Shared Computer Toolkit. In that case, all restrictions will be kept. We recommend removing all restrictions before uninstall SteadyState and all the earlier versions. This restriction may also be configured by some third party programs.

     

    Regards,

    Tuesday, November 13, 2007 2:08 AM