software package disappeared in GPO after access rights change

Hi,

in GPO, this item

Computer > Software settings > Assigned applications > IE8_package

was on *Security tab* set "**Authenticated users**" to "**Deny**".
After that it disappeared from GPO, it is there, but nowhere shown.

The intention was to disable installation of that package for now, yet
having other packages in that GPO still installed. I know it was stupid
decision now.

Is there any way to display that package back? Please help.


[1]: http://en.wikipedia.org/wiki/Group_Policy

try resetting permissions on GPO-specific objects/folders in AD and SYSVOL.
Refer to http://support.microsoft.com/kb/216359 for instructions how to
identify them...

hth
Marcin

"sirka" <> wrote in message
news:FFA33024-9BA5-4705-9879-...
> Hi,
>
> in GPO, this item
>
> Computer > Software settings > Assigned applications > IE8_package
>
> was on *Security tab* set "**Authenticated users**" to "**Deny**".
> After that it disappeared from GPO, it is there, but nowhere shown.
>
> The intention was to disable installation of that package for now, yet
> having other packages in that GPO still installed. I know it was stupid
> decision now.
>
> Is there any way to display that package back? Please help.
>
>
> [1]: http://en.wikipedia.org/wiki/Group_Policy

Hi, Marcin, in policy directory
C:\WINDOWS\SYSVOL\...\Policies\{4F57DDC6-724C-4537-9656-EF4690AD8A8D}\Machine\Applications\

.... there are three files regarding that SW install:
{59952201-EAA2-4AFC-9A9A-BE7240F00FAC}.aas
{8C5D9910-3C7C-4B94-BAD2-2A3C066AAB69}.aas
ADE.CFG

second one (starting 8C5..) is the disappeared package - but every file has
the same (and Auth.users allowed) permissions.

At least I know, which GUID to look for. But where?


"Marcin" wrote:

> try resetting permissions on GPO-specific objects/folders in AD and SYSVOL.
> Refer to http://support.microsoft.com/kb/216359 for instructions how to
> identify them...
>
> hth
> Marcin
>
> "sirka" <> wrote in message
> news:FFA33024-9BA5-4705-9879-...
> > Hi,
> >
> > in GPO, this item
> >
> > Computer > Software settings > Assigned applications > IE8_package
> >
> > was on *Security tab* set "**Authenticated users**" to "**Deny**".
> > After that it disappeared from GPO, it is there, but nowhere shown.
> >
> > The intention was to disable installation of that package for now, yet
> > having other packages in that GPO still installed. I know it was stupid
> > decision now.
> >
> > Is there any way to display that package back? Please help.
> >
> >
> > [1]: http://en.wikipedia.org/wiki/Group_Policy
>
>
> .
>

as I stated earlier - you need to check permissions in SYSVOL and AD -
following the instructions in the article I referenced...

hth
Marcin

"sirka" <> wrote in message
news:0DADBF86-0A5F-4EF6-B7DC-...
> Hi, Marcin, in policy directory,
> C:\WINDOWS\SYSVOL\...\Policies\{4F57DDC6-724C-4537-9656-EF4690AD8A8D}\Machine\Applications\
>
> ... there are three files regarding that SW install:
> {59952201-EAA2-4AFC-9A9A-BE7240F00FAC}.aas
> {8C5D9910-3C7C-4B94-BAD2-2A3C066AAB69}.aas
> ADE.CFG
>
> second one (starting 8C5..) is the disappeared package - but every file
> has
> the same (and Auth.users allowed) permissions.
>
> At least I know, which GUID to look for. But where?
>
>
> "Marcin" wrote:
>
>> try resetting permissions on GPO-specific objects/folders in AD and
>> SYSVOL.
>> Refer to http://support.microsoft.com/kb/216359 for instructions how to
>> identify them...
>>
>> hth
>> Marcin
>>
>> "sirka" <> wrote in message
>> news:FFA33024-9BA5-4705-9879-...
>> > Hi,
>> >
>> > in GPO, this item
>> >
>> > Computer > Software settings > Assigned applications > IE8_package
>> >
>> > was on *Security tab* set "**Authenticated users**" to "**Deny**".
>> > After that it disappeared from GPO, it is there, but nowhere shown.
>> >
>> > The intention was to disable installation of that package for now, yet
>> > having other packages in that GPO still installed. I know it was stupid
>> > decision now.
>> >
>> > Is there any way to display that package back? Please help.
>> >
>> >
>> > [1]: http://en.wikipedia.org/wiki/Group_Policy
>>
>>
>> .
>>

Marcin,
* article is about identifying GUID or friendly name of GPO: I know both of
them, it's written in previous posts
* permissions of mentioned GPO directory on SYSVOL (and its subdirectories)
are correct
* permissions of mentioned GPO in AD are correct

* permissions for AuthUsers for mentioned SW package in GPO template were
set to Deny, that's why it's outside abilities of AD console to see the
package and bring it back to life (but it's not managable and living its own
life in system - that's dangerous)

I know this question is a real challenge.

Sirka

"Marcin" wrote:

> as I stated earlier - you need to check permissions in SYSVOL and AD -
> following the instructions in the article I referenced...
>
> hth
> Marcin
>