So I finally started playing around with Application Control so we can start removing admin rights on user's local machines. For a "test" I decided to use Windows Disk Defragmenter and Elevate Process Rights Policy to allow a user without admin rights to run it. For the life of me I can not get it to work. I have also tested the Run Deny for Firefox and it works so I know the client computer is getting the policies. I'll give you a run down of what I have done.
-Created a user in our domain for testing purposes with only "User" rights.
-I started Disk Defrag and watched what process was started. The result being dfrgntfs.exe which is located in C:\WINDOWS\system32.
-In that location is also dfrg.msc and dfrgfat.exe.
-First I Created a collection here:
-Then created a folder here for Defrag:
-Then created filters for each shown here:
(I know .mcs isn't a executable but it was one attempt at getting this to work.)
-Next I created an Policy
I then added my "Test Pig" to that collection, updated the client's agent and tested. No luck.
I have spent 2 days on this and defrag still won't run.
NOTE: I created a filter for mmc.exe to run with admin rights for testing purposes and added it to the Defrag policy. Now when I start Defrag I get the pop-up message that mmc.exe was stated with elevated rights yet defrag still gives me the message"You must have Administrator privileges to defragment a volume." Then I created another collection for mmc.exe,created its own policy and added the filter to the policy then pointed it at the mmc.exe collection. Finally added the test computer to that collection too and tested...no go still.
I'm sure I'm missing something trivial but I'm at a loss. HELP!
Help with Application Control
Linear Mode
