Software Restriction Policy and WSUS

B@discussions.microsoft.com Pete B

unread,

Dec 17, 2007, 5:10:00 AM12/17/07

to

Hi all,

I'm hoping one of you mght be able to solve my problem. I have an issue with
WSUS and SRP in white list mode. I use deny all and add exceptions. The issue
is that when I add the policy to an OU, the windows updates are downloaded
from the WSUS server but all the updates will fail. When I remove the SRP
policy, all the updates suceed. I'm sure i'm missing something quite simple
but I can't see it. I have included a list of some of the exceptions I have
added.

Thanks.

%HKEY_CURRENT_CONFIG% - PATH – UNRESTRICTED

%HKEY_CURRENT_USER%– PATH - UNRESTRICTED

%HKEY_LOCAL_MACHINE%– PATH - UNRESTRICTED

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SystemRoot%– PATH - UNRESTRICTED

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SystemRoot%*.exe– PATH - UNRESTRICTED

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SystemRoot%System32\*.exe– PATH - UNRESTRICTED

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%– PATH - UNRESTRICTED– PATH - UNRESTRICTED

%HKEY_USERS%– PATH - UNRESTRICTED

%PROGRAMFILES%– PATH - UNRESTRICTED

%USERPROFILE%\Start Menu\Programs\Startup– PATH - UNRESTRICTED

%WINDIR%– PATH - UNRESTRICTED

\\WSUSserver– PATH - UNRESTRICTED

C:\windows\*– PATH - UNRESTRICTED

C:\WINDOWS\SoftwareDistribution\– PATH - UNRESTRICTED

c:\windows\system32\– PATH - UNRESTRICTED

command.com 50 KB 04/08/2004 13:00:00 – HASH - RESTRICTED

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run – PATH -
UNRESTRICTED

Microsoft Code Signing PCA – CERTIFICATE - UNRESTRICTED

Microsoft Corporation – CERTIFICATE - UNRESTRICTED

Microsoft Root Authority – CERTIFICATE - UNRESTRICTED

Pete B

unread,

Dec 17, 2007, 5:13:06 AM12/17/07

to

Forgot to say that the SRP is being applied on computer startup.

Jian-Ping Zhu [MSFT]

unread,

Jan 8, 2008, 3:39:44 AM1/8/08

to

Dear Customer,

Firstly, I'm sorry for the delay and all the inconvenience this might cause.

Thank you for your post. This is Neo and I will be assisting you in this
post.

From your description, I understand that:

You link one GPO to one OU in which you enable Software Restriction
Policies and only give access rights to Unrestricted software. After that,
computers in that OU can ' t perform Windows Update after downloading the
updates from WSUS Server. If you disable the SRP, then the update works.
You ask whether there are any exception of unrestricted software lists you
might miss.

If there is any misunderstanding, please let me know.

Analysis and suggestions:
======================

There is an easy way to check what access rights are necessary for running
Windows Update. After we enable Software Restriction Policies, if there is
any access denied by SRP, a warning message will be recorded in Application
Log of System Event Logs. The event source of this warning properties is
Software Restriction Policy.

Therefore, I recommend you run the update again, and then please open Event
Log and check the application logs to find whether there are any warning
messages. If yes, please check the event source and event description of
the warning properties. If the event source is Software Restriction Policy,
you could find the detailed information about what access is denied in
event description. After that, please try to add that access path to your
exception lists and have another test.

I hope this helps.

By the way, please note we are Windows Group Policy newsgroup and we mainly
focus Windows Group Policy issues here.
So, I will mainly provide suggestions on group policy side in this thread.

However, you are also welcome to post WSUS related questions to our WSUS
queues:

Microsoft.public.windowsupdate

The engineers and newsgroup members there are more experienced on
WSUS-related issues, and should be able to provide you with suggestions on
this kind of issues.

Thanks again for using our products and have a nice day!

Sincerely,
Neo Zhu,
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Pete B

unread,

Jan 8, 2008, 5:02:00 AM1/8/08

to

Thanks for your reply. I put the post in the group policy section as all of
the SRP settings are set via a group policy so I thought it was the right
section. I now that if an application is blocked, an event is written to the
event log but in this case it is not! There are no errors in the event log.
All of the updates just fail. As soon as I remove the GPO, all updates
succeed. That does make me think it is a GPO issue!

Jian-Ping Zhu [MSFT]

unread,

Jan 9, 2008, 5:19:23 AM1/9/08

to

Dear Customer,

Thank you for your quick reply!

To narrow down the issue, please do the test in this way:

1. After the update files are downloaded successfully from WSUS server,
please open Event log and then save and clear the current application logs.

2. Please try to run the update manually on client PC.

3. If the update failed, please check the application logs again and save
the log as *.evt file.

4. Please send the log file to me at v-j...@microsoft.com

5. Please also send me the WindowsUpdate.log under
%systemroot%\WindowsUpdate.log

6. If possible, please do the same test on other PCs in the OU which you
link the SRP policy to, and please check whether the result is similar.

Thank you for your time and I look forward to hearing from you. :

Sincerely,
Neo Zhu

Microsoft Online Support
Microsoft Global Technical Support Center
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Jian-Ping Zhu [MSFT]

unread,

Jan 11, 2008, 5:55:33 AM1/11/08

to

Dear Customer,

How's everything going?

I'm wondering if you have finished the test or if you have any further
questions.

Please feel free to respond to the newsgroups if I can assist further.

Pete B

unread,

Jan 11, 2008, 5:01:05 PM1/11/08

to

Sorry,
I've been away from work for the last couple of days but will test this on
Tuesday when I return.
Thanks,
Peter

Jian-Ping Zhu [MSFT]

unread,

Jan 14, 2008, 6:16:24 AM1/14/08

to

Dear Peter,

Thank you for your feedback.

I look forward to hearing from you.

Thanks again for your time and have a nice day!

Jian-Ping Zhu [MSFT]

unread,

Jan 21, 2008, 4:00:17 AM1/21/08

to

Hello Peter,

I'm wondering if you have finished the test or if you have any further
questions.

Please feel free to respond to the newsgroups if I can assist further.

Thanks.