Applocker is a new tool in Windows 7 and the new Windows Server that replaces the software restriction policies feature. This new tool will allow you to create new rules, and limit how and what users can access such as scripts, executable, windows installer files and dlls. The applocker Microsoft management console (MMC) snap-in is organized into four areas called rule collections. The four collections are executable files, scripts, windows installer files, and dll files.
- You will need to change the application identity service to be set as Started and Automatic.
- Open the Local Security Policy editor.
- Double click on Application Control Policies to expand it, then select a rule collection that you want to create a new rule in.
- If you have not already created default rules for the selected rules collection, then you will need to right click on the selected rule collection and click on Create Default Rules.
- Right click on the selected rule collection, and click on Create New Rule.
- Click on the next button.
- Select Allow or Deny as the action you want to use for the selected User or Group.
- If you do not want to have this rule applied to Everyone (default), then click on the Select button to select the User or Group you want to allow or deny instead.
- To enter a user name:Type the user account name and click on the Check Names button. To select a user or group:Click on the Advanced button. Click on the Find Now button, select the User or Group that you want to apply this rule to, and click on OK.
- Click on OK.
- Click on Next.
IF YOU WANT A PUBLISHER RULE CONDITION
INFO: This condition identifies an application based on its digital signature and extended attributes.The extended attributes, which are obtained from the binary resource, contain the name of the product that the application is part of and the version number of the application.Publisher conditions can be created to allow applications to continue to function even if the location of the application changes or if the application is updated.
- Select (dot) Publisher, and click on Next.
- Click on the Browse button.
- Navigate to the file you want to allow or deny access to, select it, and click on Open.
- Use the slider to select which properties you want included to define the rule. As you move the slider down, the more properties are added and makes the rule more specific for the selected file above. Click on Create.
IF YOU WANT A PATH RULE CONDITION
INFO: This condition is used to select a specific file or folder path location on your computer or on the network.
- Select (dot) Path, and click on Next.
- Select Browse Files or Browse Folders path to apply this rule to. If you specify a folder path, then all files in that folder will be included and affected by this rule.
- Navigate to the file or folder that you want allow or deny access to, select it, and click on Open or OK.
- Click on the Create button.
IF YOU WANT A FILE HASH RULE CONDITION
INFO: When the file hash condition is chosen, the system computes a cryptographic hash of the identified file. Select this option if you want to create a rule for an application that is not signed.
- Select (dot) File hash, and click on Next.
- Select Browse Files or Browse Folders path to apply this rule to. If you specify a folder path, then all files in that folder will be included and affected by this rule.
- Navigate to the file or folder that you want allow or deny access to, select it, and click on Open or OK.
- When done, click on the Create button.
Related posts:
