For the love of God. Why is Applocker not available on windows 7 Pro?

[reggiep]

I spent a good half a day banging my head against the desk as I just couldn't get Applocker to block access to apps no matter what I tried. I then stumbled across the fact that it doesn't work in Windows 7 pro. Nice one MS. Why would anyone running Pro need it? Huh?

[saundersmatt]

Aye, you're correct.

Looks like you'll need to get Software Assurance so that you can run enterprise.

Matt

[ZeroHour]

Yeh it should be on both tbh but I find SRP better anyway.

[jamesfed]

As far as I understand Windows 7 Pro is designed for SMBs and home users who want network backup/file sync ect.

Enterprise is the one schools should be looking at with things like App Locker (as you found out) and Bitlocker ect...

After all under EES its cheap as chips

[SYNACK]

Yea, thats why they put out Enterprise any why it bugs the hell out of me when I have to clean up after someone who installed pro sitewide for some weird reason when using a schools agreement which gives access to Enterprise. I've had to reimage two sites thanks to this so I could use bitlocker.

[reggiep]

Yep, We fell for it and have made an image ready to roll out to our new domain with Pro. Now we have to start again as there is no upgrade path. Unless anyone know differently!

[TechMonkey]

Well it is no help to you but thanks for posting as it'll stop me from falling into the same trap

[patters98]

Yea, thats why they put out Enterprise any why it bugs the hell out of me when I have to clean up after someone who installed pro sitewide for some weird reason when using a schools agreement which gives access to Enterprise. I've had to reimage two sites thanks to this so I could use bitlocker.

As someone who fell for it I'll tell you how. In the Volume Licensing portal Microsoft chose to list Windows 7 Pro filed under 'Windows', just as all versions of Windows Vista (inc. Enterprise) had been.

However, for some unknown reason they decided to list Windows 7 Enterprise under the category 'Software Assurance Benefits' several pages in, IIRC. So early adopters of Windows 7 were left assuming that maybe they had re-jigged which editions a Select Agreement customer was entitled to. After all, the Volume Licensing portal was unlikely to be wrong, right? And you could clearly see that Vista had been laid out sensibly.

So I installed 150 Windows 7 Pro workstations by accident too. Luckily, they're all being replaced this summer anyway. While I was researching (in vain) how to in-place upgrade them I found a post by some poor guy who had accidentally rolled out over 1,000 Pro machines at a university. Poor bloke

[Oaktech]

However, for some unknown reason they decided to list Windows 7 Enterprise under the category 'Software Assurance Benefits' several pages in, IIRC. So early adopters of Windows 7 were left assuming that maybe they had re-jigged which editions a Select Agreement customer was entitled to. After all, the Volume Licensing portal was unlikely to be wrong, right? And you could clearly see that Vista had been laid out sensibly.

Yes, yes it was... We rolled out 80 machines at a primary school for this very reason. It's reimage time in the summer when we make the new domain live.

[Hedghog]

Thank goodness I look at edugeek regularly. I have just fallen into this trap but I am only in the testing phase of setting up MDT to do all the hard work. It was going well until now, but it will give me a chance to tidy a few things up.

[chazzy2501]

wow, I'm about to pushout 7pro! I'll have to rethink it now. I'm on EES and asumed I only had 101 Enterprise installs (101FTE count) am I wrong?

[Hedghog]

@chazzy2501
Not exactly, with EES you get two keys - one a KMS key for key management services and a MAK key which as you have noticed is limited to 100 initially but you can go back to microsoft for more if you want to run just with MAK keys. The expected method of activation for Win 7 Pro or Enterprise is via KMS ( which is how it works out of the box) but you can force it to use a MAK key. To get KMS validation to work you need a server running 2008 R2, 2008 or 2003 Sp1 with additions. If you are using server 2008 R2 you will need a KMS key running rather than the OEM MAK key. I have found this out the hard way. You will need at least 25 clients loaded before it will validate but once it reaches the 25 bingo they will all validate at once.
If you need any other info there are lots of posts here about this and the help system on the licencing portal is very goog as well ( except for the bit about needing your KMS host server running with a KMS licence.
edit
Just reread my notes I think it may also be possible to run Win 7 as a KMS host.

[sparkeh]

wow, I'm about to pushout 7pro! I'll have to rethink it now. I'm on EES and asumed I only had 101 Enterprise installs (101FTE count) am I wrong?

You can install on as many machines as you want (well machines with a windows licence).

[liveman2]

Hi, a great alternative is ProgramKiller, that is if you don't want the hassle of changing every single installation on your network. It's a free download from: Cool Solutions: Program Killer . I would use this tool if you don't want to use software restriction policies or applocker. The tray icon can be hidden and configuration can be loaded from a network share, as configuration is stored in a text and batch file it's easy to update. the only problem is that the program can be circumvented if a user re-names an executable. I would say this program is useful for blocking Windows built in applications such as Games.

[dhomer]

Yes it's a bit weird I see this is the same for Windows 8 Windows 8 editions - Wikipedia, the free encyclopedia, they give you AppLocker for all server editions.

It's a bit counter intuitive as Pro supports GPO and it's a core GPO setting.



Dave