Microsoft Update and Software Restrictions Policy

We use Software Restriction Policy (SRP) to limit access to certian parts of
our harddrives. First and foremost is the root C:\

Recently Microsoft Updates that run out of randomly named folders (e.g. .NET
2.0 SP 1, IE 7, etc...) have started failing, citing SRP as the cause.

This fails whether an automatic update occurs or I am logged in as a local
administrator. I have SRP set for "All users except local administrators" but
that does now work.

Any ideas?

PA
Fri Mar 28 17:28:30 PDT 2008

Assuming you use WSUS, see this archived thread:
http://groups.google.com/group/microsoft.public.windows.group_policy/browse_frm/thread/dcfb33c08566785a
===========================
WSUS-specific newsgroup: microsoft.public.windows.server.update_services

On the web:
http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.server.update_services

In your newsreader:
news://msnews.microsoft.com/microsoft.public.windows.server.update_services
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

the_nuge wrote:
> We use Software Restriction Policy (SRP) to limit access to certian parts
> of
> our harddrives. First and foremost is the root C:\
>
> Recently Microsoft Updates that run out of randomly named folders (e.g.
> .NET
> 2.0 SP 1, IE 7, etc...) have started failing, citing SRP as the cause.
>
> This fails whether an automatic update occurs or I am logged in as a local
> administrator. I have SRP set for "All users except local administrators"
> but that does now work.
>
> Any ideas?

thenuge
Tue Apr 01 08:31:11 PDT 2008

Thanks pa bear, but this isn't very helpful.

My group policy is local and I'm not using WSUS. I can see the srp errors
and it's telling me that even though I have set SRP in local group policy to
"Apply to all users except administrators" it's not working and it is denying
all users AND administrators the ability to run restricted files in that
folder.

"PA Bear [MS MVP]" wrote:

> Assuming you use WSUS, see this archived thread:
> http://groups.google.com/group/microsoft.public.windows.group_policy/browse_frm/thread/dcfb33c08566785a
> ===========================
> WSUS-specific newsgroup: microsoft.public.windows.server.update_services
>
> On the web:
> http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.server.update_services
>
> In your newsreader:
> news://msnews.microsoft.com/microsoft.public.windows.server.update_services
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> the_nuge wrote:
> > We use Software Restriction Policy (SRP) to limit access to certian parts
> > of
> > our harddrives. First and foremost is the root C:\
> >
> > Recently Microsoft Updates that run out of randomly named folders (e.g.
> > .NET
> > 2.0 SP 1, IE 7, etc...) have started failing, citing SRP as the cause.
> >
> > This fails whether an automatic update occurs or I am logged in as a local
> > administrator. I have SRP set for "All users except local administrators"
> > but that does now work.
> >
> > Any ideas?
>
>

PA
Tue Apr 01 13:37:52 PDT 2008

Then I'd recommend that you...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.
--
~PA Bear

the_nuge wrote:
> Thanks pa bear, but this isn't very helpful.
>
> My group policy is local and I'm not using WSUS. I can see the srp errors
> and it's telling me that even though I have set SRP in local group policy
> to
> "Apply to all users except administrators" it's not working and it is
> denying all users AND administrators the ability to run restricted files
> in
> that folder.
>
> "PA Bear [MS MVP]" wrote:
>
>> Assuming you use WSUS, see this archived thread:
>> http://groups.google.com/group/microsoft.public.windows.group_policy/browse_frm/thread/dcfb33c08566785a
>> ===========================
>> WSUS-specific newsgroup: microsoft.public.windows.server.update_services
>>
>> On the web:
>> http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.server.update_services
>>
>> In your newsreader:
>> news://msnews.microsoft.com/microsoft.public.windows.server.update_services
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> the_nuge wrote:
>>> We use Software Restriction Policy (SRP) to limit access to certian
>>> parts
>>> of
>>> our harddrives. First and foremost is the root C:\
>>>
>>> Recently Microsoft Updates that run out of randomly named folders (e.g.
>>> .NET
>>> 2.0 SP 1, IE 7, etc...) have started failing, citing SRP as the cause.
>>>
>>> This fails whether an automatic update occurs or I am logged in as a
>>> local
>>> administrator. I have SRP set for "All users except local
>>> administrators"
>>> but that does now work.
>>>
>>> Any ideas?