Hello,
We use Software Restrictions to block users from launching Outlook on their client machines. We do however allow some users to run Outlook and we do this by assigning them to a group which has Deny permissions to the Software Restrictions GPO.
This has been in place for some time and has been working well, but recently several users have complained that they cannot run Outlook any more. We check GPResult and this suggests that the Software Restrictions GPO is now being applied even though there has been no change in AD Group Membership.
The issue is resolved by a combination of GPUpdate and reboots/logons but the same user may experience the same issue the next day.
As I say there have been no changes to Group Membership or the actual GPO.
We've configured UserEnv logging for some users but this just confirms that when the functionality is "broken" they are getting the Software Restrictions GPO applied and when it is subsequently "fixed" they are no longer applying the Software Restrictions GPO. It doesn't explain WHY they see this change from one state to another.
The only other clue we have is this seems to only be affecting XP machines, none of our users using a Windows 7 machine have reported this issue, but it's not all the XP users who are seeing the problem.
This one has me stumped!