SRP doesn't work

I created SPR rules and made them "disallowed" on my office PC, XP. I have done all necessary steps, allowing to run only from Windows and Program Files, path rules. I've done it on my PC with Win-7 and they work.

But on my office PC, XP I can run any installer from the desktop. Obviously they don't work. What's wrong?

 

Is your office PC on a domain? Maybe some other policy overriding it?

 

Running as Admin in XP and applying rules for all users except admins is the only one I can think of, your other systems are Windows 7, so it is easy to forget XP has no UAC. In Vista and higher you run as basic user, even when you have Admin rights (so rule applies even when you have All users except local administrators selected in Vista and higher)

 

that is the clue it has to be disallow for all users too

 

Thank you all.

On this PC my account belongs to "Debuggers; Administrators". I applied SRP to all users. It doesn't work anyway.

This Enforcement Properties doesn't have options for certificates. I guess this equals to "ignore certificate rules".

Maybe this is effect of some domain rules? Is there a way to check it?