Software restriction policies let administrators control what types of software users can run on their computers. Doing so protects computers against malicious software and potential conflicts. Software restriction policy can be implemented through Group Policy, making it easy to apply to multiple computers. You can also implement software restriction policy on a standalone computer through the Local Security Policy.

Software restriction policies can be used to:

• Control what software can run on computers
• Restrict access to specific files on multi-user computers
• Prevent executable files from running
• Identify the users which the restrictions will apply
• Identify those users who can add trusted publishers

When you implement a software restriction policy, you need to determine the security level: Unrestricted or Disallowed. With the Unrestricted security level, all software is allowed to run which means you must configure additional rules to block specific software. Conversely, with the Disallowed security level, no software is allowed to run which means you must configure additional rules to allow specific software. However, it is usually easier to create a few allow rules as opposed to many block rules.

To configure a restriction policy through Group Policy:

1. Open Active Directory Users and Computers.
2. Locate the appropriate container (the Organizational Unit containing the client computers). Right click the container and select Properties.
3. From the Group Policy tab, click the appropriate Group Policy Object and click Edit.
4. Navigate to Windows Settings\Security Settings\Software Restriction Policy.
5. Open the Security Levels folder to set the default security level (Unrestricted or Disallowed).
6. Open the Additional Rules folder to identify one or more applications and whether they are allowed to run.

• Office 2007 Home and Student (Full Product, PC)
• Aspire ONE A110-1588 Blue Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 8GB SSD, Windows XP, 8.9″ LCD)
• Aspire One AOA110-1995 Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 8GBX2 SSD, Windows XP, 8.9″ LCD)
• Office 2007 Professional (Full Product, PC)
• Windows XP Professional w/SP2 (Full Product)
• Eee PC 1000HE Black Netbook (1.66GHz Intel Atom N280, 1GB DDR2, 160GB HDD, Windows XP, 10.2″ LCD)
• Aspire One AOA110-1137 Black Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 8GB SSD, Windows XP, 8.9″ LCD)
• Office 2007 Small Business (Upgrade, PC)
• Norton AntiVirus 2009 (Full Product)
• Norton Internet Security 2009 - 1 User/3 PC
• Office 2003 Professional (Full Product, PC)
• Photoshop Elements 7 (Full Product, PC)
• Mini 2140 Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 160GB HDD, Windows XP, 10.1″ LCD)
• NC10-14GB Blue Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 160GB, Windows XP, 10.2″ LCD)
• mini NB205-N210 Netbook (1.66GHz Intel Atom N280, 1GB DDR2, 160GB HDD, Windows XP, 10.1″ LCD)
• ThinkPad X200T Tablet PC (1.86GHz Intel Core 2 Duo Mobile SL9400, 2GB DDR2, 160GB, Windows XP Pro, 12.1″ LCD)
• Acrobat 9 Pro (Full Product, PC)
• Inspiron Mini 10v Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 160GB HDD, Windows XP, 10.1″ LCD)
• Photoshop CS4 (Full Product, PC)
• Ideapad S10e Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 160GB HDD, Windows XP, 10.1″ LCD)
• Office 2007 Professional (Academic)
• Aspire One AOD250-1116 Netbook (1.6GHz Intel Atom N270, 1GB DDR2, 160GB HDD, Windows XP, 10.1″ LCD)
• Mini 1010nr Black Netbook (1.6GHz Intel Atom N270, 512MB DDR2, 8GB SSD, Windows XP, 8.9″ LCD)
• ThinkPad T400 Notebook (2.4GHz Intel Core 2 Duo Mobile P8600, 3GB DDR3, 160GB HDD, DVD±RW DL, Windows XP Pro, 14.1″ LCD)
• Intuit QuickBooks Pro 2009 (Full Product)