How do I block executables from running using applocker in a corporate / enterprise environment?

Question

Hello, I am looking for helps blocking executables and unwatned apps from being ran on corporate and field PCs. We have windows pro and enterprise editions and I am looking for what would be the most efficient way of doing this. I have tried configuration profiles in intune which give mixy results with delays in processing the rules. I tried using application control within local security policy on a test PC, and this gave me a few different configurations that I can block the store entirely, but that blocks all of the apps that windows and microsoft publish. This makes things like the camera and calculator and basic windows services to be blocked --not good. I tried a test user group to apply to app control policies too and it seemed to apply it to admins as well being my admin profile. So to conclude, I am wanting to find a way to block executables from running at the user level, but if we need to remote into a pc and download something, we can with our admin permissions. This seemed to change whenever apps became a thing, haha. But I feel like im close to getting what I want, its just fine tuning it. This is also for windows 10 and 11 devices. This is the XML file i found and have been trying at this link in order to allow the store, but block microsoft apps from being downloaded. It doesnt only work for one user, it works on the device. Even though I have the exception for the user added ( https://call4cloud.nl/2020/06/managing-apps-in-the-microsoft-store/  )

<RuleCollection Type="Appx" EnforcementMode="Enabled">
	<FilePublisherRule Id="617edd5b-3360-4281-9724-21e453587fce" Name="Whitelist Store apps" Description="Allow Store apps while whitelisting store." UserOrGroupSid="S-1-1-0" Action="Allow">
		<Conditions>
			<FilePublisherCondition PublisherName="CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="*"> 
				<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
			</FilePublisherCondition>
		</Conditions>
	</FilePublisherRule>
	<FilePublisherRule Id="617edd5b-3360-4281-9724-21e443587fce" Name="Whitelist Microsoft Windows app" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
		<Conditions>
			<FilePublisherCondition PublisherName="CN=MICROSOFT Windows, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="*">
				<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
			</FilePublisherCondition>
		</Conditions>
	</FilePublisherRule>
</RuleCollection>

Answer 1

@Zachary Ralph Thanks for posting in Q&A. For the Applocker CSP, it only applies to device scope. That is to say, all the users on this device will get this policy. That is the reason why it doesn't only work for one user.

https://learn.microsoft.com/en-us/windows/client-management/mdm/applocker-csp#applicationlaunchrestrictionsgroupingstoreappspolicy

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.