APPDATA install problem due to software restriction policy. HELP!

[Koldov]

Hi All,

 

After putting in the APPDATA software restriction policy to stop conficker, obviously nothing runs from there.

 

I am trying to put an exception in which would allow a specific program to run.

 

The program is trying to run C:\Users\USERNAME\appdata\local\temp\irsetup.exe but obviously failing!

 

Could anyone please give me the exact syntax to allow this to run please?

 

Kol.

[TG_MI]

We have a similar Software restriction policy in place and an unintended consequence was that Dropbox failed to run. Our work around was to take the digital certificate that Dropbox was signed with, export it, then import it as a "Trusted Publisher" within the same GPO that our Software restriction policy was defined in, which I believe, automatically creates a certificate based rule under the software restriction-->Additional Rules node in the GPO and sets it to unrestricted, but I might have also done that manually - it's been a while. After that, Dropbox ran just fine. So if "irsetup.exe" is signed, you can use a certificate rule and set it to "unrestricted". If it's not signed, I think you can also do a hash rule.

 

Check the section about rule precedence on this page and I think you'll get it:

Using Software Restriction Policies to Protect Against Unauthorized Software

[psydii]

We tend to use the the file hash.

 

 

Pretty sure that using the cert is pretty easy though, just tell app locker to trust apps signed by a specific publisher, no need to export anything?

Edited July 15, 2014 by psydii

[TG_MI]

That may very well be Psy. Maybe I'm doing it the hard way. I've always just grabbed it by:

 

Navigate to .exe in question --> Properties-->Digital Signatures-->Details-->View Certificate-->Details-->Copy to File (Then follow the prompts of the wizard to save a .cer file)

 

Once you have the .cer, you can import it to the Trusted Publishers node within a GPO and create a software restriction policy using the cert, setting it to unrestricted.

[Arthur]

just tell AppLocker to trust apps signed by a specific publisher, no need to export anything

+1. This is what I do too. There isn't any need to export certificates.

 

 

^ When you get to this step, browse for the executable, then move the slider on the left to adjust how specific you want the Publisher rule to be. In the screenshot above everything that has been signed with Google's digital signature will be allowed to run.

Edited July 15, 2014 by Arthur