Sp3 & Software Restriction Policy

[FLegman]

Greetings,

After installing and updating a windows xp pro sp3 machine i ran into error messages when i set a software restriction policy.

Access dinied (for lack of enough privilegies) error messages occured anytime i want to launch an application or even select "Proprieties" from "My Computer" drop down menu, though i was running under Admin account for the configuration needs.

Things got so dready that even rebooting was not allowed, leaving me with no choice than hard reboot !!

ERD boot cd let me get back in and roll back.

I'd love to know if anyone came accross such a scenario and what's the possible cause(s) and solution.

NB:
1- i have another box that got updated from Sp2 to Sp3 and which had and still have Software Restriction Policy inplimented.

2- as described above there was nothing i could launch after applying the security policy, so i therefore couldn't make screen capture or get the logs from events viewer


In advance thank you for your input.

 

[mechBgon]

Yes, no problems here with SRP on a fresh install of XP SP2 that was updated directly to SP3 first thing. I'd be curious to know what went wrong, but it sounds like we'll never know

However, when SRP blocks an event on WinXP, the resulting prompt doesn't refer to lack of privilege, it says that such-and-such was prevented by Software Restriction Policy. Is that what you were seeing? And did it have the two default rules to permit C:\Program Files and C:\Windows as Unrestricted?

 

[FLegman]

Greetings MechBgon,

However, when SRP blocks an event on WinXP, the resulting prompt doesn't refer to lack of privilege, it says that such-and-such was prevented by Software Restriction Policy.

This information made me "replay the entire scenario step by step" in order to spot what went wrong and this is what happened :

Just after setting up the Software Restriction Policy, i download and launched RootKit Unhooker; then gave it permission to run from Commodo Firewall pop up window.
This is were it all happened !! by granting it permission to run as "Isolated Application" instead of "Trusted Application" or clicking window after window, my OS kind of get jamed.

I repeated the operation with Rootkit Unhooker and Xlite (unlinke Rootkit Unhooker, didn't bring down the OS).

So there is the cause of the trouble i had.

Thank you very much MechBgon for helping me sort things out.

Have a very nice Weekend.

Merci beaucoup.

 

[mechBgon]