-6

How can i block all executables in a machine unless i verify it. I have multiple clients and i want to do it as programatically (I am using Visual-Studio-2010). It can be done through registry using DisallowRun but if i change the name of exe to notepad1.exe ,registry thing will not work. I want to get control of all the exe's present ,like the way antivirus has.

closed as too broad by Sven, Dave M, joeqwerty, TheCleaner, Grant Dec 2 '14 at 14:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

7

The correct setting Microsoft added for what you need is AppLocker by GPO.

You can add policy by filehash, filepublisher or path.

With the filehash, it's harder for an user to bypass it, unless he get another version, but you could block the publisher too.

  • I want to write a code for that. – jain Dec 2 '14 at 14:50
  • 1
    It's easier by GPO, but you can use powershell. "Get-AppLockerFileInformation –Directory “\\SERVER\SHARE\FOLDER” -Recurse" will list all .exe with what policy it support in the target path. After we do a policy, "Get-AppLockerFileInformation -Directory \\SHARE\SERVER\FOLDER -Recurse | New-AppLockerPolicy -RuleType Publisher,Hash -User Everyone -RuleNamePrefix TEST -XML | Out-File .\TEST.XML" and after we apply it, "Set-AppLockerPolicy –XMLPolicy .\test.XML" – yagmoth555 Dec 2 '14 at 16:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.