The working environment
- Windows Server 2008 R2
- IIS 7.5 (With a website that runs on classical mode)
- .NET 3.5
- Certificate (Code signing certificate (to sign files)
What I am trying to achieve:
The code signing certificate is being used to sign files (in my case .ddl files). The intention is that the server (iis 7.5) is only allowed to run DDL's that are signed by this certificate for security issues. So if a site gets published or a user places a non signed ddl the site should be unable to run.
The only thing i have found to put up these complicated DDL rules was with "Applocker"(found in local security policy (secpol.msc) ).
When placing rules on a location everything seems to be working correctly (also in the event viewer logger it shows the ddl is being prevented from running if a rule is in place). So in other words AppLocker is working fine but i am unable to get it to work with IIS.
BUT when placing rules on the location where the IIS 7.5 website is located nothing happens (ddl path rule that prevents .ddl from being executed unless signed). What is also strange is that when i run my website through IIS 7.5 no logging comes throught in the event viewer for AppLocker.
So it seems IIS7.5 is not even checking the rules put up by AppLocker. I have tried running the website under several users but with no success.
Seems i am close to the solution but without this last step i am unable to get this to work, anyone have any suggestions or solution how i can handle this DDL rule problem?