Hi everyone, need help or solution for the following problem: Does someone know how to use Designated File Types under GP\software Restriction? I created a rule not to allow everyone to run executable file listed in designated file types on user's desktop, say the rule shows as follow: *\Documents and Settings\%USERNAME%\Desktop\ Security Level=disallowed I am expecting that users try to run program listed in desinaged file types are restricted. However, I dont have *.vbs/*.bat added in designated file type list. Why are they still blocked to run with these extension? Although I can set a rule to allow to run with these ext, I still have no clue how it works to use designated file types. Can anyone give me advice? Second problem: Does anyone know where to deploy in GP to set permission on specific program directory, say \Program Files\Symantec, thanks again!