A signed msi file is able to be downloaded and executed, even though others are blocked with group policy

Question

Hi

Can someone please save my sanity. I have lots of GPOS in my domains and somewhere there is a rule that is allowing virtru.msi to be installed and run by any user in my organisation. All other msi are blocked.
How can i find out why this one is being allowed to run? Easy way as i have so many GPO's and users.
Applocker is on and msi are listed just as an fyi

Thanks

Answer 1

Hi @CCurtis777

Apparently Microsoft doesn´t have a specific tool that would allow you to create list of GPOs by actions. In this case, it would require narrowing down the issue, decomposing the elements involved.

In this sense, the best option would be to isolate a user(s) that could install the mentioned MSI file, the run a RSOP of applied policites for example with GPRESULT /H OUTPUT.HTML and review the policies applied.

Additionally you can use the powershell Get-GPOReport to get GPO, that would allow to run XML report for each GPO in the specified domain:

https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gporeport?view=windowsserver2022-ps

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--