AppLocker Intune Policy does not work properly

Question

AppLocker Intune Policy does not work properly

fishizza 0

I have created default AppLocker policies and then exported the XML file to use this to create a corresponding Intune policy. Specifically for the EXE policy this does not work. We are running VMware Horizon agent on the base system and with the locally applied AppLocker policy it is able to run. When I apply this to an Intune policy it prevents the app from running with the 8004 AppLocker error logged. Any help would be appreciated. EventLog

Intune Policy

XML

fishizza 0 Reputation points

2023-03-01T17:59:09.33+00:00

AppLocker_KioskDefaults.xml

fishizza 0


<RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePathCondition Path="%PROGRAMFILES%\*" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePathCondition Path="%WINDIR%\*" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>
  </RuleCollection>

Lu Dai-MSFT 22,811 Reputation points Microsoft Vendor

2023-03-02T02:31:16.55+00:00

@fishizza Thanks for posting in our Q&A.

For this issue, it is more complex, and I know little about it. With Q&A limitation, it is suggested to create an online support ticket to get more accurate help. Here is the support link:

https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding and hope everything goes well with you.

fishizza 0 Reputation points

2023-03-01T17:59:09.33+00:00

AppLocker_KioskDefaults.xml
fishizza 0 Reputation points

2023-03-01T17:59:23.5366667+00:00

<RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection>
Lu Dai-MSFT 22,811 Reputation points Microsoft Vendor

2023-03-02T02:31:16.55+00:00

@fishizza Thanks for posting in our Q&A.

For this issue, it is more complex, and I know little about it. With Q&A limitation, it is suggested to create an online support ticket to get more accurate help. Here is the support link:

https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding and hope everything goes well with you.

Answer 1

fishizza 0

We ran an AutoPilot Reset on the device and after it came back up it worked properly

AppLocker Intune Policy does not work properly

1 answer

Activity