Default Security Levels

By Author: Mike Jones
Total Articles: 256

Software restriction policies run on one of two default mcse training security levels:
Unrestricted, which allows software to run with the full rights of the user who is logged on to the computer
Disallowed, which does not allow the software to run, regardless of the access rights of the user who is logged on to the computer
If the default level is set to Unrestricted, you can identify and create rules for the set of programs that you want to prohibit from running. If the default level is set to Disallowed, you can identify and create rule exceptions for the programs that you trust to run. Either option can be set as the default security level for a GPO, but when a GPO is created, the default security level is Unrestricted.
Setting the Default Security Level to Disallowed
When you set the default security level to Disallowed, most software applications are restricted and you must apply a rule for nearly every application you want to run. Some applications must remain unrestricted for the operating mcse 2003 system to function at all.
These registry path rules are created as a safeguard against locking yourself and all users out of the system. Only advanced users should consider modifying or deleting these rules.
If you decide to use a default security level of Disallowed, consider the following issues:
If a computer must run logon scripts, you must include a path rule that allows the scripts to run. For more information, refer to the Path Rule section in this lesson.
Startup items are placed in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. If startup items must run, you must create a rule for them.
For more information, refer to the Path Rule section in this lesson.
Many applications start other programs to perform certain tasks, and you must create ailes for these other programs. For example, Microsoft Word starts the Clip Organizer to manage clip art.
Security settings define the security behavior of the system. Through the use of GPOs in Active Directory, administrators can apply security profiles to sites,domains, and OUs in the enterprise.
The policies in the Account Policies security area can be applied only to the root domain of the domain tree, and cannot be applied to sites or OUs.
You set autoenrollment of computer and user certificates in the Autoenrollment Settings Properties dialog box, which you can access by opening Autoenrollment
Settings in Computer Configuration or User Configuration/Windows Settings ccna exam/Security Settings/Public Key Policies in a GPO for a site, domain, or OU.