I keep getting '*' violates pattern constraint of '([0-9]{1,5}.){3}[0-9]{1,5}'. when trying to create a new Applocker policy

Question

This issue started infrequently and has gotten to the point where it is happening all the time now. When you go to create a new policy whether file hash, publisher or a windows installer rule after clicking on create, it'll wait a couple of seconds then pop the error. I've tried on each of our DCs with the same result. The only reference I can find online seems to be specific to an xml file for CyberArk. Any help or direction would be appreciated.

Thanks

Answer 1

Hello Donny Brown,

Thank you for posting in Microsoft Community forum.

Please check if any applocker entry has wrong or unnecessary symbols, numbers or letters, etc.

Here is a similar thread.

xml validation error due to pattern constraint failure (microsoft.com)

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

Thank you for your response, Daisy, I've gone through the rules as best as I could - we have over 2000 of them and everything looks ok to me. I did create a new 2016 system off the network, made it a DC and imported the exported ruleset and didn't get any errors so I'm not thinking that it is the existing rules. Over the past 3-4 months we have found that repeated attempts will eventually lead to success. When the error first started, it was very infrequent and now is happening about 99% of the time. Would you happen to have any other ideas or strategies to determine where the issue is?

Thank you,

Donny

Answer 3

Hello Donny Brown,

Good day！

Did you set all the Applocker within only one GPO?
If so, you can try to create a new GPO and set Applocker policy in the new GPO and check if it helps.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 4

Thank you Daisy - we actually tried this last week and it worked. It looks like the legacy AppLocker GPO just needed "refreshed". We're going to let this new one soak for a bit and then will replace the default domain policy.

Thank you again for your help.

Donny

Answer 5

Hello Donny Brown,

Good day！

Thank you for your update and sharing.

I am so glad that you can set Applocker policy in new GPO.

Have a nice day!

Best Regards,
Daisy Zhou