Windows Server 2003 : Implementing Software Restriction Policies (part 3) - Implementing Software Restriction Policies - Creating a Certificate Rule, Creating an Internet Zone Rule

6.3 Creating a Certificate Rule

Create a certificate rule to automatically trust software from a trusted source in a domain without prompting the user or to run files in disallowed areas of your operating system. Certificate rules can be applied to scripts and Windows Installer packages. They do not apply to files with .exe or .dll filename extensions.

To create a certificate rule, complete the following steps:

1.	Access the Group Policy Object Editor console for a GPO.
2.	In the Group Policy Object Editor console, click Computer Configuration, double-click Windows Settings, double-click Security Settings, and then double-click Software Restriction Policies.
3.	Right-click Additional Rules, and then click New Certificate Rule.
4.	In the New Certificate Rule dialog box, shown in Figure 2, click Browse and then select a certificate. Figure 2. The New Certificate Rule dialog box
5.	In the Security Level list, select one of the following: Disallowed, which does not allow the software to run, regardless of the access rights of the user who is logged on to the computer Unrestricted, which allows software to run with the full rights of the user who is logged on to the computer
6.	Type a description for this rule, and then click OK.

6.4 Creating an Internet Zone Rule

Create an Internet zone rule to identify software from a zone that is specified through Internet Explorer. Zone rules apply only to Windows Installer packages.

To create an Internet zone rule, complete the following steps:

1.	Access the Group Policy Object Editor console for a GPO.
2.	In the Group Policy Object Editor console, click Computer Configuration, double-click Windows Settings, double-click Security Settings, and then double-click Software Restriction Policies.
3.	Right-click Additional Rules, and then click New Internet Zone Rule.
4.	In the New Internet Zone Rule dialog box, shown in Figure 3, select a zone from the Internet Zone list. Figure 3. The New Internet Zone Rule dialog box
5.	In the Security Level list, select one of the following: Disallowed, which does not allow the software to run, regardless of the access rights of the user who is logged on to the computer Unrestricted, which allows software to run with the full rights of the user who is logged on to the computer