This MS answer speaks volumes to their approach to security (I had similar made to me in the past)
09.06.06 - Vendor response "Software Restriction Policy and Group Policy are not meant to be complete security features...For full security, we recommend using ACLs to protect the appropriate resources in your environment..."
Maybe they should update some of their docs:
From http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
"...Software restriction policies are a new feature in Microsoft(r) Windows(r) XP and Windows Server 2003. This important feature provides administrators with a policy-driven mechanism for identifying software programs running on computers in a domain, and controls the ability of those programs to execute. Software restriction policies can improve system integrity and manageability—which ultimately lowers the cost of owning a computer..." "...Software restriction policies are a part of Microsoft's security and management strategy to assist enterprises in increasing the reliability, integrity, and manageability of their computers. Software restriction policies are one of many new management features in Windows XP and Windows Server 2003. This article provides an in-depth look at how software restriction policies can be used to: Fight viruses,Regulate which ActiveX controls can be downloaded,Run only digitally signed scripts,,Enforce that only approved software is installed on system computers,Lockdown a machine..."
From http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx
"...Software restriction policy provides administrators with a way to identify software and control its ability to run on local computers. This tool can help protect computers that run Microsoft(r) Windows(r) XP Professional against known conflicts and safeguard them against malicious software such as viruses and Trojan horse programs. Software restriction policy integrates fully with the Active Directory(r) directory service and Group Policy. You can also use it on stand-alone computers...." Dinis Cruz Owasp .Net Project
