AppLocker policies not applying

Question

Hi,

We are currently looking at deploying AppLocker to our Windows 10 Enterprise devices via group policy, the issue we have is that the policies keeps reverting to the local AppLocker policy on the machine instead of taking the settings from the group policy.

By this I mean we get dummy rules added and I am not sure where they are coming from?

I can clear these local policies by running this PowerShell script and this clears all local policies and if anything else have been applied to the machine:

Import-Module
Set-AppLockerPolicy -XMLPolicy ClearLocal.xml
Set-AppLockerPolicy -XMLPolicy clearAppLocker.xml
appidtel.exe stop [-mionly]
sc.exe config appid start=demand
sc.exe config appidsvc start=demand
sc.exe config applockerfltr start=demand
sc.exe stop applockerfltr
sc.exe stop appidsvc
sc.exe stop appid
Set-Location -Path 'HKLM:\SOFTWARE\TEWVApps'
New-Item -Name 'AppLocker' -Force
New-ItemProperty -Path 'HKLM:\SOFTWARE\Apps\AppLocker' -Name 'Cleared' -Value 1

And then I apply the group policy I would like and it works for about a week and then we see the dummy rules again which starts getting blocks in the event log even though things are allowed.

Only thing I can think which may be causing this behaviour is we used to have WDAC running through Config Manager but we have now put that into Audit mode and my test machines I have put in an exclusion group.

Has anyone else see the dummy rule apply to their machines?

Thanks

Answer 1

facing the exact same issue , no SCCM is configured we used intune instead . any solution for this ?