AppLocker DLL Rules Blocking Legitimate System Components

Question

After enabling AppLocker DLL rules, several legitimate Windows system DLLs under C:\Windows\Assembly are being blocked, causing some applications to crash at startup. What is the recommended way to generate and deploy default publisher-based rules for trusted native assemblies using PowerShell?

Answer 1

Use PowerShell's AppLocker cmdlets to generate the default DLL rules from trusted files rather than manually creating individual allow rules. For example, use Get-AppLockerFileInformation to collect information about the trusted native assemblies and New-AppLockerPolicy to generate publisher-based rules from that file information.

For the Windows assemblies, you can target C:\Windows\Assembly and generate publisher rules with:

Get-ChildItem -Path "C:\Windows\Assembly" -Recurse -File | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher -User Everyone -RuleNamePrefix "Default Windows Assemblies" -Xml > C:\Temp\DefaultDllRules.xml

Review the resulting XML before deployment, because C:\Windows\Assembly contains a large number of files and the generated policy may be broader than intended. After validating it, merge the rules into the existing AppLocker policy rather than replacing your entire policy, then deploy the resulting policy through Group Policy or your management solution. The key point is to generate publisher rules from the actual trusted files, since publisher rules are preferable to individual hash rules for legitimate Windows components that are routinely serviced or updated.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin