I want to block all apps except IE for everyone except admin

[Fahrenheit]

Hi,

I just want to block all applications except Internet explorer for all the users excepts administrators.
So a user just have access to internet with internet explorer, but Administrators can connect to internet with all applications.

I tried to configure it with the WRP policies set to:

1.Default rights are ignored

2. "Everyone" with ban list "Not client application name is empty".

3. "Everyone" with ban list "Not client application name equals iexplore.exe"

4. "Adminstrators group" with unrestricted rights


BUT it doesn't work the way I desired.
With these parameters, everyone have unrestricted rights.
If I remove the Administrator group of the Policies, it works fine.

I need help, because I don't understand why it doesn't run with my parameters....

[Fahrenheit]

I found it!

I just have to specify that the admin have unrestricted rights only if they are members of the group "Admin" in the advanced parameters of the Policies...

Funny, isn't it?