Enable certificate rules

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To enable certificate rules

For your local computer
For a Group Policy object, and you are on a server that is joined to a domain
For a Group Policy object, and you are on a domain controller or a on workstation that has the Windows Server 2003 Administration Tools Pack installed
For only domain controllers, and you are on a domain controller or on a workstation that has the Administration Tools Pack installed

Open Local Security Settings.
In the console tree, click Security Options.

Where?
- Security Settings/Local Policies/Security Options
In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
Do one of the following, and then click OK:
- To enable certificate rules, click Enabled.
- To disable certificate rules, click Disabled.

Notes

To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
To open Local Security Policy, click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Local Security Policy.

Open Microsoft Management Console (MMC).
On the File menu, click Add/Remove snap-in, and then click Add.
Click Group Policy Object Editor, and then click Add.
In Select Group Policy Object, click Browse.
In Browse for a Group Policy Object, select a Group Policy object (GPO) in the appropriate domain, site, or organizational unit--or create a new one, and then click Finish.
Click Close, and then click OK.
In the console tree, click Security Options.

Where?
- GroupPolicyObject [ComputerName] Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
If this policy setting has not yet been defined, select the Define these policy settings check box.
Do one of the following, and then click OK:
- To enable certificate rules, click Enabled.
- To disable certificate rules, click Disabled.

Notes

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.
To open Microsoft Management Console, click Start, click Run, type mmc, and then click OK.

Open Active Directory Users and Computers.
In the console tree, right-click the Group Policy object (GPO) for which you want to enable certificate rules.
Click Properties, and then click the Group Policy tab.
Click Edit to open the GPO that you want to edit. You can also click New to create a new GPO, and then click Edit.
In the console tree, click Security Options.

Where?
- GroupPolicyObject [ComputerName] Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
If this policy setting has not yet been defined, select the Define these policy settings check box.
Do one of the following, and then click OK:
- To enable certificate rules, click Enabled.
- To disable certificate rules, click Disabled.

Notes

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.
To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Open Domain Controller Security Settings.
In the console tree, click Security Options.

Where?
- GroupPolicyObject [ComputerName] Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.
If this policy setting has not yet been defined, select the Define these policy settings check box.
Do one of the following, and then click OK:
- To enable certificate rules, click Enabled.
- To disable certificate rules, click Disabled.

Notes

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.
To open Domain Controller Security Policy, click Start, click Control Panel, double-click Administrative Tools, and then double-click Domain Controller Security Policy.

Note

Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.