Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've setup a basic group policy consisting of the default Applocker rules. Per Microsoft's technet article on the subject, any files not explicitly allowed to run by the policy are supposed to be blocked from running. After deploying this policy and verifying it was being applied to the correct user using gpresult, I was still able to download and run an exe from the internet, an exe that was saved to the user profile's temp folder. It was at that point I did more googling, and saw that the App Identity service had to be running, and it wasn't: So, like any good admin, I started it, set it to automatic, and rebooted just in case. The policy still didn't work after restarting. Below is a screenshot of the current policy.

enter image description here

I added the deny rules explicitly because the default rules weren't working. I correctly applied the policy to the machine and verified that the rules are enforced (it says so in the screenshot). I used the Test-AppLockerPolicy cmdlet to verify that the rule is should be blocking the EXEs and MSIs from running, but it doesn't. Open to most suggestions, no matter how ludicrous they may sound.

Update

Forgot to add that I checked the event log for AppLocker during this whole fiasco, and it was blank. Not a single entry the entire time.

share|improve this question
2  
Look in the event log under Applications and Services Logs -> Microsoft -> Windows -> AppLocker. In those logs you should see allowed/denied message, and also "The AppLocker policy was applied successfully to this computer.". –  longneck Oct 18 '13 at 13:46
2  
Also, you can set your Group Policy that contains your AppLocker rules to also start the Application Identity service. –  longneck Oct 18 '13 at 13:47
    
@longneck you are right 100%: I forgot to add that I checked that log, and it was blank! And yes, eventually if I get this policy working right I will add that service to start automatically via the same gpo for consistency. –  BigHomie Oct 18 '13 at 13:50
    
There are separate rules for "Windows Installer Rules". I don't know if that's relevant to your EXE but it's worth a look. If you drop a copy of an installed program's EXE (winword.exe, etc.) into a folder that's not permitted in your Executable Rules, is the user able to execute it? –  joeqwerty Oct 18 '13 at 14:35
1  
Is the user a local Admin? Is the machine Windows 7 Pro? –  joeqwerty Oct 18 '13 at 14:48

1 Answer 1

If your path block was not defined correctly then that would explain you situation.

For example if you were to use the %userprofile% environment variable. There are only a subset of the environment variables available through GPO/AppLocker and that's not one of them.

I have had success with the following path rule:

%osdrive%\users\*
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.