Windows AppLocker

AppLocker is a new feature in Windows 7 and Windows Server 2008 R2 that allows you to specify which users or groups can run particular applications in your organization based on unique identities of files. If you use AppLocker, you can create rules to allow or deny applications from running.

Today's organizations face a number of challenges in controlling application execution, including the following:

  • Which applications should a user have access to run?

  • Which users should be allowed to install new software?

  • Which versions of applications should be allowed?

  • How are licensed applications controlled?

To meet these challenges, AppLocker provides administrators with the ability to specify which users can run specific applications. AppLocker allows administrators to control the following types of applications: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.msi and .msp), and DLL files (.dll and .ocx). This helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls from users running inappropriate applications.

The following topics provide more information about AppLocker:

  • Overview of Windows AppLocker

  • Configuring AppLocker Rules

  • Configuring AppLocker Rule Enforcement

  • Configuring AppLocker Rule Exceptions

  • AppLocker Rule Properties

  • Windows Versions That Support AppLocker


Overview of Windows AppLocker

AppLocker is a new feature in Windows 7 and Windows Server 2008 R2 that replaces the Software Restriction Policies feature. AppLocker contains new capabilities and extensions that reduce administrative overhead and help administrators control how users can access and use files, such as executable files, scripts, Windows Installer files, and DLLs. Using AppLocker, you can:

  • Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file.

  • Assign a rule to a security group or an individual user.

  • Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe).

  • Use audit-only mode to deploy the policy and understand its impact before enforcing it.

  • Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, the existing policy is overwritten.

  • Simplify creating and managing AppLocker rules by using AppLocker PowerShell cmdlets.

For more information about AppLocker rules, see Understanding AppLocker Rules.

What has changed?

The following table compares AppLocker to Software Restriction Policies.

Feature | Software Restriction Policies | AppLocker
Rule scope | All users | Specific user or group
Rule conditions provided | File hash, path, certificate, registry path, and Internet zone rules | File hash, path, and publisher rules
Rule types provided | Allow and deny | Allow and deny
Default rule action | Allow or deny | Deny
Audit-only mode | No | Yes
Wizard to create multiple rules at one time | No | Yes
Policy import or export | No | Yes
Rule collection | No | Yes
PowerShell support | No | Yes
Custom error messages | No | Yes

AppLocker requirements

AppLocker is available in all editions of Windows Server 2008 R2 and in Windows 7 Ultimate and Windows 7 Enterprise. To use AppLocker, you need:

  • A computer running Windows Server 2008 R2, Windows 7 Ultimate, Windows 7 Enterprise, or Windows 7 Professional to create the AppLocker rules. Windows 7 Professional can be used to create the rules, but the rules cannot be enforced on computers running Windows 7 Professional. The computer can be a domain controller.

  • For Group Policy deployment, at least one computer with the Group Policy Management Console (GPMC) or Remote Server Administration Tools (RSAT) installed to host the AppLocker rules.

  • Computers running Windows Server 2008 R2, Windows 7 Ultimate, or Windows 7 Enterprise to enforce the AppLocker rules that you create.


Configuring AppLocker Rules

The procedures in this section are designed to help you configure AppLocker rules in your organization.

This section contains the following topics:

  • Understanding AppLocker Rules

  • Start the Application Identity Service

  • Create Default AppLocker Rules

  • Automatically Generate AppLocker Rules

  • Create an AppLocker Rule

  • Edit an AppLocker Rule

  • Delete an AppLocker Rule


Understanding AppLocker Rules

Rule collections

The AppLocker Microsoft Management Console (MMC) snap-in is organized into four areas called rule collections. The four rule collections are executable files, scripts, Windows Installer files, and DLL files. These collections give the administrator an easy way to differentiate the rules for different types of applications. The following table lists the file formats included in each rule collection.

Note

The DLL rule collection is not enabled by default. To learn how to enable the DLL rule collection, see Enforce AppLocker Rules.

Rule collection | Associated file formats
Executable | .exe .com
Scripts | .ps1 .bat .cmd .vbs .js
Windows Installer | .msi .msp
DLL | .dll .ocx
Important

If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed applications.

Caution

When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used.

Rule conditions

Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash.

Publisher

This condition identifies an application based on its digital signature and extended attributes. The digital signature contains information about the company that created the application (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the application is part of and the version number of the application. The publisher may be a software development company, such as Microsoft, or the information technology department of your organization.

Note

Use a publisher condition when possible. Publisher conditions can be created to allow applications to continue to function even if the location of the application changes or if the application is updated.

When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving the slider down or by using a wildcard character (*) in the product, file name, or version number fields.

Note

To enter custom values while creating a rule in the Create Rules Wizard, you must select the Use custom values check box. When this check box is selected, you cannot use the slider to make the rule more or less specific.

The file version controls whether a user can run a specific version, earlier versions, or later versions. You can choose a version number and then configure the following options:

  • Exactly. The rule applies only to this version of the application.

  • And above. The rule applies to this version and all later versions.

  • And below. The rule applies to this version and all earlier versions.

The following table describes how a publisher condition is applied.

Option |  | The publisher condition allows or denies…
All signed files |  | All files that are signed by a publisher.
Publisher only |  | All files that are signed by the named publisher.
Publisher and product name |  | All files for the specified product that are signed by the named publisher.
Publisher and product name, and file name |  | Any version of the named file for the named product that are signed by the publisher.
Publisher, product name, file name, and file version | Exactly | The specified version of the named file for the named product that are signed by the publisher.
Publisher, product name, file name, and file version | And above | The specified version of the named file and any new releases for the product that are signed by the publisher.
Publisher, product name, file name, and file version | And below | The specified version of the named file and any older versions for the product that are signed by the publisher.
Custom |  | You can edit the Publisher, Product name, File name and Version fields to create a custom rule.

Path

This condition identifies an application by its location in the file system of the computer or on the network.

AppLocker uses path variables for directories in Windows.

Note

While two of these path variables use the same format as Windows environment variables, they are not environment variables. AppLocker can only interpret AppLocker path variables.

The following table details these path variables.

Windows directory or drive | AppLocker path variable | Windows environment variable
Windows | %WINDIR% | %SystemRoot%
System32 | %SYSTEM32% | %SystemDirectory%
Windows installation directory | %OSDRIVE% | %SystemDrive%
Program Files | %PROGRAMFILES% | %ProgramFiles% and %ProgramFiles(x86)%
Removable media (for example, CD or DVD) | %REMOVABLE% |
Removable storage device (for example, USB flash drive) | %HOT% |
Important

Because a path condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can then copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile.

File hash

When the file hash condition is chosen, the system computes a cryptographic hash of the identified file.

AppLocker default rules

AppLocker allows you to generate default rules for each of the rule types.

Executable default rule types:

  • Allow members of the local Administrators group to run all applications.

  • Allow members of the Everyone group to run applications that are located in the Windows folder.

  • Allow members of the Everyone group to run applications that are located in the Program Files folder.

Windows Installer default rule types:

  • Allow members of the local Administrators group to run all Windows Installer files.

  • Allow members of the Everyone group to run digitally signed Windows Installer files.

  • Allow members of the Everyone group to run all Windows Installer files located in the Windows\Installer folder.

Script default rule types:

  • Allow members of the local Administrators group to run all scripts.

  • Allow members of the Everyone group to run scripts located in the Program Files folder.

  • Allow members of the Everyone group to run scripts located in the Windows folder.

DLL default rule types:

  • Allow members of the local Administrators group to run all DLLs.

  • Allow members of the Everyone group to run DLLs located in the Program Files folder.

  • Allow members of the Everyone group to run DLLs located in the Windows folder.

For more information, see Create Default AppLocker Rules.

AppLocker rule behavior

If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in %SystemDrive%\FilePath to run, only executable files located in that path are allowed to run.

A rule can be configured to use either an allow or deny action:

  • Allow. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule.

  • Deny. You can specify which files are not allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule.

Important

You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented.

Rule exceptions

You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an application, you can create a special rule for that subset. For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run Windows but does not allow anyone to run Registry Editor. The effect of this rule would prevent users such as help desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor.

AppLocker wizards

You can create custom rules in two ways:

  1. The Create Rules Wizard enables you to create one rule at a time. For more information, see Create an AppLocker Rule.

  2. The Automatically Generate Rules Wizard allows you to select a folder, select a user or group to apply the rule to, and then create many rules at one time for that folder. This wizard automatically generates allow rules only. For more information, see Automatically Generate AppLocker Rules.

Additional considerations

  • By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. Administrators should maintain an up-to-date list of allowed applications.

  • There are two types of AppLocker conditions that do not persist following an update:

    • File hash condition. File hash conditions can be used with any application because a cryptographic hash value of the application is generated at the time the rule is created. However, the hash value is specific to that exact version of the application. If there are several versions of the application in use within the organization, you need to create file hash conditions for each version in use and for any new versions that are released.

    • A publisher condition with a specific product version set. If you create a publisher condition that uses the Exactly file condition option, the rule cannot persist if a new version of the application is installed. A new publisher condition must be created, or the rule version must be edited to be made less specific.

  • If an application is not digitally signed, you cannot use a publisher condition.

  • AppLocker rules cannot be used to manage computers running a Windows operating system earlier than Windows 7. Software Restriction Policies must be used instead.

  • If AppLocker rules are defined in a Group Policy object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs.

  • When an AppLocker rule is set to Audit only, the rule is not enforced. When a user runs an application that is included in the rule, the application is opened and runs normally, and information about that application is added to the AppLocker event log.

  • A custom configured URL can be included in the message that is displayed when an application is blocked.

  • Expect an increase in the number of help desk calls initially because of blocked applications. As users begin to understand that they cannot run applications that are not allowed, the help desk calls may decrease.

Additional references

  • Configuring AppLocker Rules


Start the Application Identity Service

Before you can enforce AppLocker policies, you must start the Application Identity service by using the Services snap-in console.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To start the Application Identity service

  1. Click Start, click Administrative Tools, and then click Services.

  2. In the Services snap-in console, double-click Application Identity.

  3. In the Application Identity Properties dialog box, click Automatic in the Startup type list, click Start, and then click OK.
Note

You can also use a Group Policy object (GPO) setting that configures the Application Identity service Startup type to Automatic. For information about using Group Policy, see Planning and Deploying Group Policy (http://go.microsoft.com/fwlink/?LinkId=143689).

Additional references

  • Configuring AppLocker Rules


Create Default AppLocker Rules

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To create default rules

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Right-click the appropriate rule type for which you want to automatically generate default rules. You can automatically generate rules for executable, Windows Installer, and script rules.

  5. Click Create Default Rules.

Additional references

  • Configuring AppLocker Rules


Automatically Generate AppLocker Rules

AppLocker allows you to automatically generate rules for all of the files within a folder. It will scan the specified folder and create the condition types that you choose for each file in that folder.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To automatically generate rules

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Right-click the appropriate rule collection for which you want to automatically generate rules. You can automatically generate rules for executable, Windows Installer, and script rules.

  5. Click Automatically Generate Rules.

  6. On the Folder and Permissions page, click Browse to choose the folder to be analyzed. By default, this is the Program Files folder.

  7. Click Select to choose the security group in which the default rules should be applied. By default, this is the Everyone group.

  8. The wizard provides a name in the Name to identify this set of rules box based on the name of the folder that you have selected. Accept the provided name or type a different name, and then click Next.

  9. On the Rule Preferences page, choose the conditions that you want the wizard to use while creating rules, and then click Next. For more information about rule conditions, see Understanding AppLocker Rules.

    Notes
    • The Reduce the number of rules created by grouping similar files check box is selected by default. This helps you organize AppLocker rules and reduce the number of rules that you create by performing the following operations for the rule condition that you select:
      • One publisher condition is created for all files that have the same publisher and product name.

      • One path condition is created for the folder that you select. For example, if you select C:\Program Files\ProgramName\ and the files in that folder are not signed, the wizard creates a rule for %programfiles%\ProgramName\*.

      • One file hash condition is created that contains all of the file hashes. When rule grouping is disabled, the wizard creates a file hash rule for each file.

  10. Review the files that were analyzed and the rules that will be automatically created. To make changes, click Previous to return to the page where you can change your selections. After reviewing the rules, click Create.

Additional references

  • Configuring AppLocker Rules


Create an AppLocker Rule

You can create new rules by using the Create Rules Wizard.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To create a new rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Right-click the rule collection for which you want to create the rule, and then click Create New Rule.

  5. On the Before You Begin page, click Next.

  6. Click Allow or Deny to allow or deny the files contained within the rule.

  7. Click Select. In the Select User or Group box, type the appropriate security group or user, and then click OK.

  8. Click Next.

  9. Click the appropriate rule condition for this rule. You can choose from Publisher, Path, or File hash, and then click Next.

  10. Depending on the rule condition you selected, you are asked for different criteria:

    • Publisher rule condition. Click Browse to select the file for which you want to extract the publisher information. To edit the publisher information, select the Use custom values check box, and then edit the values. Click Next.

    • Path rule condition. Navigate to the file or folder by clicking Browse Folders or Browse Files. Optionally, you can type the path into the Path box. Click Next.

    • File hash rule condition. Navigate to the file or folder by clicking Browse Folders or Browse Files. Click Next.

  11. (Optional) On the Exceptions page, specify the publisher or path that you want to exclude from the rule, and then click Next.

    Note

    You cannot create exceptions for file hash rules.

  12. In the Name box, type a name that you can use to identify the rule.

  13. In the Description box, type a description that explains the purpose of this rule.

  14. Click Create.

Additional references

  • Configuring AppLocker Rules


Edit an AppLocker Rule

You can use AppLocker to edit rules that you have created.

Editing a publisher rule

The following procedure describes how to edit a publisher rule.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To edit a publisher rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Click the appropriate rule collection.

  5. In the Action pane, right-click the publisher rule, and then click Properties.

  6. Click the appropriate tab to edit the rule properties.

    • Click the General tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group for which this rule should apply.

    • Click the Publisher tab to configure the certificate's common name, the product name, the file name, or file version of the publisher.

    • Click the Exceptions tab to create or edit exceptions.

    • When you finish updating the rule, click OK.

Editing a file hash rule

The following procedure describes how to edit a hash rule.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To edit a file hash rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Choose the appropriate rule collection.

  5. In the Action pane, right-click the file hash rule, and then click Properties.

  6. Click the appropriate tab to edit the rule properties.

    • Click the General tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply.

    • Click the File Hash tab to configure the files that should be used to enforce the rule. You can use the Browse Files button to add a specific file or the Browse Folders button to add all files in a specified folder.

    • When you finish updating the rule, click OK.

Editing a path rule

The following procedure describes how to edit a path rule.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To edit a path rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Choose the appropriate rule collection.

  5. In the Action pane, right-click the path rule, and then click Properties.

  6. Click the appropriate tab to edit the rule properties.

    • Click the General tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply.

    • Click the Path tab to configure the path on the computer in which the rule should be enforced.

    • Click the Exceptions tab to create exceptions for specific files in a folder.

    • When you finish updating the rule, click OK.

Additional references

  • Understanding AppLocker Rules

  • Configuring AppLocker Rules


Delete an AppLocker Rule

We recommend reviewing the active AppLocker rules occasionally and deleting any rules that are no longer needed.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To delete a rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, and then double-click AppLocker.

  4. Click the appropriate rule collection for which you want to delete the rule.

  5. In the details pane, right-click the rule to delete, click Delete, and then click Yes.

Additional references

  • Configuring AppLocker Rules


Configuring AppLocker Rule Enforcement

The procedures in this section help you configure enforcement for AppLocker rules in your organization.

This section contains the following topics:

  • Understanding AppLocker Rule Enforcement

  • Enforce AppLocker Rules

  • Audit AppLocker Rules


Understanding AppLocker Rule Enforcement

The three AppLocker enforcement modes are described in the following table.

Enforcement mode | Description
Not configured | This is the default setting. If linked Group Policy objects (GPOs) contain a different setting, that setting is used. If enforcement is not configured but rules are present in the corresponding rule collection, those rules are enforced.
Enforce rules | Rules are enforced.
Audit only | Rules are audited but not enforced. The audit-only enforcement mode helps you determine which applications are affected by the policy before enforcing the policy. When the AppLocker policy for a rule collection is set to Audit only, rules for that rule collection are not enforced. When a user runs an application that is affected by an AppLocker rule, information about that application is added to the AppLocker event log.

When AppLocker policies from various GPOs are merged, both the rules and the enforcement modes are merged. The most similar Group Policy setting is used for the enforcement mode, and all rules from linked GPOs are applied.

For information about GPOs and Group Policy inheritance, see the Group Policy Planning and Deployment Guide (http://go.microsoft.com/fwlink/?LinkId=143138).

Additional references

  • Configuring AppLocker Rule Enforcement


Enforce AppLocker Rules

After AppLocker rules are created, you can enforce the rules.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enforce rules

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, right-click AppLocker, and then click Properties.

  4. On the Enforcement tab, select the Configured check box for the rule collection that you want to enforce, and then verify that Enforce rules is selected in the list for that rule collection.

  5. Repeat step 4 to configure enforcement for additional rule collections.

  6. Click OK.

Because the DLL rule collection is not enabled by default, you must perform the following procedure before you can create and enforce DLL rules.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable the DLL rule collection

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, right-click AppLocker, and then click Properties.

  4. Click the Advanced tab, select the Enable the DLL rule collection check box, and then click OK.

    Important

    Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed applications.

Additional references

  • Configuring AppLocker Rule Enforcement


Audit AppLocker Rules

You can configure all rules contained within a specified rule collection to only audit activity but not enforce rules. This may be useful if you want to test new rules before they are deployed.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure audit-only mode

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, double-click Application Control Policies, right-click AppLocker, and then click Properties.

  4. On the Enforcement tab, select the Configured check box for the appropriate rule collection, and then select Audit only in the list for that rule collection.

  5. Repeat step 4 to configure additional rule collections.

  6. Click OK.

Additional references

  • Configuring AppLocker Rule Enforcement


Configuring AppLocker Rule Exceptions

Rule exceptions allow you to specify files or folders to exclude from the rule.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure exceptions for a rule

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER. You can also:

    1. Click Start, and then click Control Panel.

    2. Click System and Security, and then click Administrative Tools.

    3. Double-click Local Security Policy.

  2. Expand Application Control Policies, and then expand AppLocker.

  3. Expand the rule collection, right-click the rule that you want to configure exceptions for, and then click Properties.

  4. Click the Exceptions tab.

  5. In the Add exception box, select the rule type that you want to create, and then click Add.

    • For a publisher exception, click Browse, select the file that contains the publisher to exclude, and then click OK.

    • For a path exception, choose the file or folder path to exclude, and then click OK.

    • For a file hash exception, choose the file or folder path to exclude, and then click OK.

Additional references

  • Windows AppLocker


AppLocker Rule Properties

There are two ways that you can edit a rule or view its properties in AppLocker:

  • In the details pane, select the rule, and then in the Action pane, click Properties.

  • In the details pane, right-click the rule, and then click Properties.

Viewing and editing rules

The Properties dialog box displays a different set of tabs based on the primary condition of the rule. For example, a rule with a publisher primary condition includes the General, Publisher, and Exceptions tab. The Exceptions tab is not displayed for rules with a primary condition set to file hash.

General tab

On the General tab, you can change the name and description of the rule, change the action of the rule (allow or deny), and change the user or group to which the rule applies.

Publisher tab

The Publisher tab is available only for rules that have publisher conditions. On the Publisher tab, you can change the publisher name, product name, file name, and file version that the rule applies to.

Path tab

The Path tab is available only for rules that have path conditions. On the Path tab, you can change the folder or file path that the rule is applied to.

File Hash tab

File hash allows you to create a rule that applies to a specific file. The File Hash tab is available only for rules that have file hash conditions. On the File Hash tab, you can add and remove files that are included in the rule.

Exceptions tab

On the Exceptions tab, you can add or edit files or folders that are excluded from the rule. The Exceptions tab is not available for file hash rules.

Additional references

  • Windows AppLocker


Windows Versions That Support AppLocker

AppLocker is available in all editions of Windows Server 2008 R2 and in Windows 7 Ultimate and Windows 7 Enterprise. Windows 7 Professional can be used to create AppLocker rules. However, AppLocker rules cannot be enforced on computers running Windows 7 Professional. Organizations should use AppLocker for all computers that support it.

Caution

If you upgrade a computer that uses Software Restriction Policies to Windows 7 or Windows Server 2008 R2 and then implement AppLocker rules, only the AppLocker rules are enforced. For this reason, it is recommended that you create a new Group Policy object (GPO) for AppLocker in environments where both Software Restriction Policies and AppLocker are used.

Additional references

  • Windows AppLocker