11

I've setup a basic group policy consisting of the default Applocker rules. Per Microsoft's technet article on the subject, any files not explicitly allowed to run by the policy are supposed to be blocked from running. After deploying this policy and verifying it was being applied to the correct user using gpresult, I was still able to download and run an exe from the internet, an exe that was saved to the user profile's temp folder. It was at that point I did more googling, and saw that the App Identity service had to be running, and it wasn't: So, like any good admin, I started it, set it to automatic, and rebooted just in case. The policy still didn't work after restarting. Below is a screenshot of the current policy.

enter image description here

I added the deny rules explicitly because the default rules weren't working. I correctly applied the policy to the machine and verified that the rules are enforced (it says so in the screenshot). I used the Test-AppLockerPolicy cmdlet to verify that the rule is should be blocking the EXEs and MSIs from running, but it doesn't. Open to most suggestions, no matter how ludicrous they may sound.

Update

Forgot to add that I checked the event log for AppLocker during this whole fiasco, and it was blank. Not a single entry the entire time.

Improve this question
13
  • 2
    Look in the event log under Applications and Services Logs -> Microsoft -> Windows -> AppLocker. In those logs you should see allowed/denied message, and also "The AppLocker policy was applied successfully to this computer.".
    – longneck
    Oct 18, 2013 at 13:46
  • 2
    Also, you can set your Group Policy that contains your AppLocker rules to also start the Application Identity service.
    – longneck
    Oct 18, 2013 at 13:47
  • @longneck you are right 100%: I forgot to add that I checked that log, and it was blank! And yes, eventually if I get this policy working right I will add that service to start automatically via the same gpo for consistency.
    – MDMoore313
    Oct 18, 2013 at 13:50
  • There are separate rules for "Windows Installer Rules". I don't know if that's relevant to your EXE but it's worth a look. If you drop a copy of an installed program's EXE (winword.exe, etc.) into a folder that's not permitted in your Executable Rules, is the user able to execute it?
    – joeqwerty
    Oct 18, 2013 at 14:35
  • 1
    Is the user a local Admin? Is the machine Windows 7 Pro?
    – joeqwerty
    Oct 18, 2013 at 14:48

2 Answers 2

Reset to default
4

If your path block was not defined correctly then that would explain you situation.

For example if you were to use the %userprofile% environment variable. There are only a subset of the environment variables available through GPO/AppLocker and that's not one of them.

I have had success with the following path rule:

%osdrive%\users\*
Improve this answer
2
  • Seconded here. I ran into the exact same issue with using the %userprofile% EV where it would not work. But switching over to the %osdrive%\users* did the trick.
    – Get-HomeByFiveOClock
    Jul 16, 2015 at 18:58
  • Switched jobs, for some reason I didn't see this answer before I left (July '14), I would have definitely tried it, it sounds like the culprit.
    – MDMoore313
    Sep 15, 2015 at 15:43
1

This is an old thread but I came across it when implementing AppLocker on our own network.

AppLocker requires the use of the Application Identity service, which is set to Manual on a default install of Win7/Server 2008 R2. You must set the Application Identity service to Automatic startup or the rules will not be enforced. You can do this with the Group Policy object where AppLocker rules are defined.

Improve this answer
2
  • Sup Wes! Yeah I saw that too, set it to auto with no avail, hope this thread helped you though
    – MDMoore313
    Apr 25, 2016 at 23:53
  • 1
    It did :-) It works fine w/ Win7. Win10 is another story. Can't even change the startup type of the service. Was going to post another question for that. I came across your thread while looking for help w/ AppLocker and ClickOnce applications.
    – Wes Sayeed
    Apr 25, 2016 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .