What are these Software Restriction Policies and are they normal?

Winver: Win 10 pro, 21H1, 19043.1288

In Local Security Policy > Software Restriction Policies > Additional Rules, I have two rules for two paths, both unrestricted:

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

Are these normal? Are they there by default or can the system run without these fine?

They are definitely not put by me, and the date added is exactly the same down to the second.

Edit: As an additional question, what happens if there are two of the same rule but one is unrestricted and other is disallowed?

dalchina said:

Can confirm I don't have these.

Interesting... I suppose it's set to allow program files and the system root folder to run if "security levels" is set otherwise? Does seem to be some mentions of this online but nothing concrete...

- - - Updated - - -

Update: I tested it and it seems like these two rules are automatically created once you add your first Software Restriction Policy via the Action tab.

Deleting both of them doesn't seem to do anything, unless you'd need to restart for it to work... Someone else would have to try that though

dalchina said:

Seems if you even click on e.g. Security levels, Basic levels, those are added.
I haven't deliberately made any changes...

Having done that I now see those... no further ideas, sorry!

Making an educated guess based on what this seems to do:
Those two are created for you to prevent you from bricking your system when you change Security Levels to Disallowed as it overrides that. Otherwise you'd be prevented from opening anything in C:\Windows and the Program Files directory.

Thankfully according to a tip here: https://docs.microsoft.com/en-us/win...nical-overview

Software restriction policies do not apply when Windows is started in Safe Mode. If you accidentally lock down a workstation with software restriction policies, restart the computer in Safe Mode, log on as a local administrator, modify the policy, run gpupdate, restart the computer, and then log on normally.

If you accidentally set something that bricks the system, you can restart in Safe Mode and that will disable any of these policies so you can fix them and run gpupdate.

To protect administrators from locking themselves out of the system, when the default security level is set to Disallowed, four registry path rules are automatically created. You can delete or modify these registry path rules; however, this is not recommended.

Seems like it's meant to be there to prevent Windows critical processes from being blocked. Interesting...
If anyone with a VM would like to run some tests if you set it to Disallowed and delete the pre-created path rules, that would be cool... Wonder what kind of error Windows gives you when it boots and can't run anything...