This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 31%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECB%3C/text%3E%3C/svg%3E)
Hopefully I'm asking this in the right area but I apologize if not, I was referred here by an Independent Advisor on the Microsoft Community forums: https://answers.microsoft.com/en-us/windows/forum/windows_10-security/what-is-blocking-the-tencent-wechat-desktop/21a0c93c-eade-4b6f-be69-6f90eaf12fad
I work for a company that does a lot of business in the PRC. We only have a couple of users located there but one of them uses the Tencent WeChat desktop application for filesharing, IMing, etc. purposes.
When they try to run this they are receiving a message that reads "This app has been blocked by your system administrator. Contact your system administrator for more info." Users/workstations everywhere have the same GPOs applied to them and I'm not seeing any GPResult discrepancies there. There is nothing unique about the setup of their PC and they are running the latest version of WeChat for Windows 10 Pro 10.0.19044. I tried poking around in Defender as well but I’m not seeing any incidents or alerts related to the end-user or their workstation.
I would very much appreciate any insight into how/why this message is appearing for this single end-user and of course if there is any more info that I can provide please let me know. Thanks in advance for your time and assistance.
what is the output of
Get-AppLockerPolicy -Effective
on the affected machine?
you could also look at events:
aplocker:
Using Event Viewer with AppLocker
WDAC:
Windows Defender Application Control operational guide
@cr.bl.c I have noticed that you add "Intune-windows" tag. To clarify this issue, did you deploy any policy (such as AppLocker policy) via intune? If not, from intune's point of view, there is no helpful information I can share with you. Thanks for your understanding.
Thanks very much for looking into this with me. I'm currently trying to co-ordinate access to the user's machine so that I can investigate all of the above.
We don't have any profiles set-up under Devices > Configuration profiles in our MEM admin center, which unless I'm mistaken is where AppLocker policies would be applied from. These are the results from my workstation--
I'm also not seeing any events in Event Viewer for Applications and Services Logs > Microsoft > Windows > AppLocker > MSI and Script. I will check this and for WDAC events on the end-user's computer regardless and report back.
Thanks for your help with this. We don't have any profiles set-up under Devices > Configuration profiles in our MEM admin center, which unless I'm mistaken is where AppLocker policies would be applied from. These are the results from my workstation--
I will check this on the end-user's computer regardless and also for WDAC events per EckiS' suggestion above.
There are no events under the various logs for Applications and Services Logs > Windows > AppLocker in Event Viewer on the user's workstation. I have to assume this is because we don't really have AppLocker configured for our environment.
I'm seeing several ID 3089 events under Applications and Services Logs > Windows > CodeIntegrity > Operational but I'm not seeing any explicit references to WeChat on these events' General/Details tabs, most appear to be referencing Microsoft Office or something else. Does it make sense to try to match the Activity CorrelationID's for these events? And if so could you possibly please tell me the best method for doing this? I apologize for my lack of understanding here.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 84%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVK%3C/text%3E%3C/svg%3E)
You shoud try to install Wechat in D or E Drive. Don't install it on C drive. I just did it. It's work.