Copyright: Saturday, January 04, 2003 15:50:12


Displays the certificate type that is automatically requested by computers, subject to the security settings of this Group Policy object.


Displays the purpose of the certificate that is automatically requested by computers, subject to the security settings of this Group Policy object.


Displays the name of the certification authority that issues the certificate that is automatically requested by computers, subject to the security settings of this Group Policy object.


Lists the locations in which you can search for a certificate.


Specifies what text to search for in a specified field of the certificate.


Provides a space to type the text you want to search for in the certificate field you have specified.


Click to find all certificates based on the criteria you have chosen.


Click to stop searching for certificates.


Click to clear the current search criteria and results in order to begin a new search.


Displays the results of the search for certificates.


Choose which field to search in certificates for the specified text.


Select to provide users who are subject to the security settings of this Group Policy object with the ability to choose certification authorities to trust.


Click to allow users who are subject to the security settings of this Group Policy object to trust only the certificates in the enterprise root certificate store.


Type in a password to protect the private key in the PKCS #12 file you are exporting.


Type in the same password as above to confirm that you have entered it correctly. The password protects the private key in the PKCS #12 file you will export.


Specifies that you want to organize the certificate view by the purpose of the certificate, such as Client Authentication and IP Security user.


Specifies that you want to organize the certificate view by the names of the certificate stores where they reside, such as Personal and Trusted Root Certification Authorities.


Specifies that you want to include the view of the physical certificate stores when viewing certificates, organized by the names of the logical certificate stores where they reside. This is primarily useful for application developers and advanced users.


Specifies that you want to display archived (or expired) certificates as well as active certificates.


Click to configure computers to not trust certification authorities whose certificates are in the Third-Party Root Certification Authorities certificate store. This configuration also disables the downloading of updated trusted third-party root certificates from the Internet.


Click to provide computers with the ability to trust certification authorities whose certificates are in the Third-Party Root Certification Authorities stores, in addition to certificates in other stores that are trusted.


Click to enable users and computers that are subject to the security settings of this Group Policy object to be authenticated using certificates that are both compliant with user principal name constraints and that are issued by certification authorities that are registered in Active Directory.


Click to enable users and computers who are subject to the security settings of this Group Policy object to be authenticated with certificates that are issued by certification authorities that are registered in Active Directory.


Click to enable computers who are subject to the security settings of this Group Policy object to use Encrypting File System (EFS) to encrypt and decrypt files and directories.


Click to disable autoenrollment for all subjects of this Group Policy object. Affected subjects must manually obtain certificates if desired.


Click to enable autoenrollment for all subjects of this Group Policy object. When selected without any other options, autoenrollment compatibility with Windows 2000 is maintained.


Click to configure subjects of this Group Policy object to use autoenrollment for complete certificate management. This includes requesting new certificates, retrieving issued certificates, renewing certificates as the near expiration, and archival of outdated and invalid certificates.


Click to configure subjects of this Group Policy object to use autoenrollment to request certificates that are based on version 2 certificate templates. The certificate template must also be configured to allow autoenrollment to work.


Displays the description of the security level.


Sets this security level as the default level. This security level will be imposed on all the programs on your computer.


Displays the current default security level.


Specifies that all users can be trusted to select trusted publishers when presented with a certificate.


Specifies that only local computer administrators have the right to specify trusted publishers on the local computer.


Specifies that Enterprise administrators have the right to specify trusted publishers at the organizational-unit, domain, or site level.


Specifies whether revocation checking will occur with regard to the publisher. You can choose this option along with the time stamp option.


Specifies whether revocation checking will occur with regard to the time stamp. You can choose this option along with the publisher option.


Lists the file types that are shared by all path rules, hash rules, and certificate rules.

See To create a path rule, To create a hash rule, or To create a certificate rule in software restriction policies Help.


Deletes the selected file type from the list of designated file types.


Provides a space for you to add the file name extension that you want to add to the designated file types list.


Adds a file type to the designated file types list after you type a file name extension.


Displays the certificate subject name that you have chosen using Browse.


Click to browse to a certificate.


Specifies the security level for the program that is associated with this certificate.


Provides a space for you to type a description for this rule.


Provides a space for you to type the path to the file or directory on which you want to apply this rule. The wildcard characters for the path rule are * and ?.


Specifies the security level for the path that you select. The security levels are Unrestricted, which allows software to run with the full rights of the logged-in user, and Disallowed, which does not allow software to run.


Specifies that this rule will apply to all the files for the directory that you select.


Specifies that only the files whose file types are included in Designated file types will have this rule applied to them. See To add or delete a designated file type in software restriction policies Help.


Provides a space for you to type a description for this rule.


Click to browse to a file or folder for which you would like to create a rule.


Displays properties of the file, such as the name of the file and the size of the file.


Click to browse to the file that you want to identify by its hash. The hash will be calculated and displayed in File hash.


Specifies a security level for this rule. The security levels are Unrestricted, which allows software to run with the full rights of the logged-in user, and Disallowed, which does not allow the software to run.


Provides a space for you to type a description for this rule.


Specifies the Internet zone that you want to apply a rule to. These zones correspond to the zones that you set in Internet Explorer. A description of the zone appears in Description. Zone rules affect Windows Installer packages only.


Specifies a security level for this rule. The security levels are Unrestricted, which allows software to run with the full rights of the logged-in user, and Disallowed, which does not allow the software to run. Zone rules affect Windows Installer packages only.


Specifies that this rule will apply to all the files for the zone that you select.


Specifies that only the files whose file types are included in Designated file types will have this rule applied to them. See To add or delete a designated file type in software restriction policies Help. Zone rules affect Windows Installer packages only.


Describes the Internet zone. Zone rules affect Windows Installer packages only.


Provides a space for the hash. You can browse to a file, and software restriction policies will calculate the hash and then display it in this box.

You can also paste the hash into this box if you calculated the hash with software restriction policies on another computer.


Specifies that the rules will not affect libraries (such as .dll files).

Because most programs need multiple .dll files to run, specifying that these files are not subject to any rules makes it unnecessary to create individual rules for each .dll file in an environment where the default security level is set to Disallowed.


Specifies that all rules will be applied to all files that are identified by rules in software restriction policies.


Specifies that all rules will be applied to all users.


Click to browse to a folder or file for which you want to create a path rule.


Specifies that all rules will be applied to all users, except local administrators.


Lists all Group Policy objects (GPOs) that are applied to this policy, in order of precedence.


Displays the date that this rule was last modified.