Windows 10: Software Restriction policy applies but does not take effect on Windows 11 machine

Hi Team,I have an issue here whereby when I pushed an GPO, basically the Software Restriction policy applies but does not take effect on Windows 11 machine. I have checked on the machine and can confirm that the policy is indeed applied but it is not blocking the application as intended. This is working for some Windows 11 machine and for some machines, its not working.Kindly advise on this on how I can rectify this issue on those machines.

:)

 

Introducing apply layered Group Policy in Windows 10 and Windows 11

Source: https://techcommunity.microsoft.com/...y/ba-p/2608462

 

Software setting group policy empty after update(s)

Mainly used on Domains when IT wants to have policies on all machines to do things that they do not want the desktop users to do, It is always going to be a empty page on a normal desktop. Local Group Policy Editor Components

• Computer Configuration: These policies apply to the local computer, and do not change per user.
• User Configuration: These policies apply to users on the local machine, and will apply to any new users in the future, on this local computer.
• Those two main categories are further broken down into sub-categories:
• Software Settings: Software settings contain software specific group policies: this setting is empty by default.

Group Policy Editor Guide: Access Options and How to Use. https://docs.microsoft.com/en-us/pre...89197(v=ws.11)

 

What are these Software Restriction Policies and are they normal?

Making an educated guess based on what this seems to do: Those two are created for you to prevent you from bricking your system when you change Security Levels to Disallowed as it overrides that. Otherwise you'd be prevented from opening anything in C:\Windows and the Program Files directory. Thankfully according to a tip here: https://docs.microsoft.com/en-us/win...nical-overview Software restriction policies do not apply when Windows is started in Safe Mode. If you accidentally lock down a workstation with software restriction policies, restart the computer in Safe Mode, log on as a local administrator, modify the policy, run gpupdate, restart the computer, and then log on normally. If you accidentally set something that bricks the system, you can restart in Safe Mode and that will disable any of these policies so you can fix them and run gpupdate. To protect administrators from locking themselves out of the system, when the default security level is set to Disallowed, four registry path rules are automatically created. You can delete or modify these registry path rules; however, this is not recommended. Seems like it's meant to be there to prevent Windows critical processes from being blocked. Interesting... If anyone with a VM would like to run some tests if you set it to Disallowed and delete the pre-created path rules, that would be cool... Wonder what kind of error Windows gives you when it boots and can't run anything...