AppLocker script enforcement rules blocking legitimate internal administrative PowerShell scripts

Question

After implementing an AppLocker script enforcement policy, we noticed an unintended side effect. End users are successfully restricted from running untrusted scripts, but internal login automation used by the helpdesk is also being denied. The scripts reside in a hidden network location instead of the approved C:\Program Files\ directory, and their execution is now blocked, interrupting workstation deployment routines.

Answer 1

Hello,

To resolve the AppLocker script block, configure an Allow rule within the Group Policy Management Console under Computer Configuration, Windows Settings, Security Settings, and Application Control Policies. While a UNC path rule will permit the scripts, using a publisher-based rule is recommended for better security if the scripts are digitally signed. Ensure the Application Identity service (AppIDSvc) is set to start automatically on all client workstations, as it is required for rule enforcement. Finally, execute gpupdate /force on the affected machines to apply the updated policy and resume deployment operations.

Domic V.