*.msi { Microsoft installer package}

*.msp { Microsoft Installer patch, modifies an already installed piece of software}

*.zap { Allows the use of non-Microsoft installer files Limitations can't remove self heal or assign.

- can only be published to users as intervention 

- May have to repackage -not easy.

* Software can be assigned

• User 
• program installed on demand or at logon
• Computers
• Installed at start-up

• Advertised in Program and Features

Basic Security levels

1. Unrestricted
2. Disallowed
3. Basic , allows all programs to run that do not need admin rights.

• Programs can be permitted based upon 
• Path
• Hash
• Certificate
• Network zone

• Allows or disallows based on location and name
• Can restrict single files or whole folders

• Allows / disallows programs based upon cyptographic hash
• its Uniquely identifies a specific file
• any changes to the file mean the hash will not match , so the rule will not appy
• Location and name of the program are irrelevant.

• Permits or denies based upon the digital signature used to sign the executable.

• Permits of denies instalaltion based upon the source of the installer file
• Based on the common Microsoft Internet Zones:

• Since it is possible to create contradictions, and order of precedence is needed:
• Hash Rule
• Certificate rule
• Network zone rule
• Path rule

• Apply GPO base upon machine specific configuration.
• Windows XP and above only
• Only one filter per GPO allowed

• Linked to site
• Affects all users and computers in the site
• Linked to domain
• Affects all users and computer in the domain
• Linked to OU
• Affects all users and computers in the OU

Order of Precedence 

LSDOU

Local ---Site-- Domain --OU

Block Policy Inheritance

• Prevents policies from being inherited from higher levels in the AD
• Can only be used at the domain and OU level
• Cannot stop a policy marked as NO Override

Loopback processing changes the list of applicableGPOs and the order in which they apply to a user

• In merge mode conflicting setting are won by loopback-enabled Group Policy.
• In repace mode all user setting are set to whatever is configured in the loopback enable Group Policy.