Applocker and application management

brandsen 26 Reputation points
2024-08-09T12:10:22.92+00:00

Hi! I am currently piloting Applocker and trying to figure out how things work handling the applocker components. I have a pretty basic setup as a start. I have no rules for spesific applications, processes or scripts.

  • Everything that is signed is allowed to run, be it executables, scripts or DLLs (Everyone / Allow )
  • Everything that is located in ProgramFiles can run freely (Everyone / Allow for ProgramFiles)
  • Admin on computers can execute everything (builtin/Administrators Allow, Path rule * )

I have verified that the rules are working in audit mode, and i have toggled the different filters on and off to see how they are working if enabled. Everything so far has worked to my expectations, however how do one handle ad-hoc software that needs to be installed on a client? If i try to manually run an installer on my test client and get that application into my programfiles folder, it now stops me from doing that, even though i am a Admin. I have not made a rule set and whitelisted applications, so i am for this scenario happy enough security wize that the aplications / executables / whatever are just digitally signed. My expectation then was that i could as an admin execute a local installer and get the application installed. What do i have to do to be able to achieve this? Are my rules just logically wrong, or is this scenario not attainable?

Most standard software would be introduced to the client through SCCM, and that works fine, so far at least. Its these ad-hoc scenarios that i am now testing to see if are possible at all. And what is normal procedure around application management on machines that are under Applocker policies?

If anyone could help me or give some pointers that would be higly appreciated :-)

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,191 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,924 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.