Applocker blocks MSI for Admins

[Sheridan]

We've put Applocker to work on our Windows 10 PCs, with rules set to allow Administrators to install anything. However if we try to install an MSI that is on a network share it is always blocked.

 

The annoying thing is that Applocker shows an event saying the MSI was prevented from running and the administrator gets the message 'The system administrator has set policies to prevent this installation' despite the full network path of the MSI being whitelisted, and no other blocking rules are in the Windows Installer Applocker rules.

 

So where is it getting the rule from, or does Applocker not work properly with 10 yet?

[Arthur]

Can you try adding one or both of these registry settings? The first one enables you to right-click an MSI and choose "Install as administrator" while the second setting enables UAC linked connections.

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\runas]
@="Install as &administrator"
"HasLUAShield"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\runas\command]
@="msiexec /i \"%1\""

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLinkedConnections"=dword:00000001

[Sheridan]

Can you try adding one or both of these registry settings? The first one enables you to right-click an MSI and choose "Install as administrator" while the second setting enables UAC linked connections.

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\runas]
@="Install as &administrator"
"HasLUAShield"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\runas\command]
@="msiexec /i \"%1\""

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLinkedConnections"=dword:00000001

 

I tried both registry settings but both result in the same message. I wish applocker worked as reliably as SRP used to!

[Arthur]

I tried both registry settings but both result in the same message.

I forgot to mention that you need to reboot for the second setting to take effect (unless you have already tried that?).

[Arthur]

The annoying thing is that Applocker shows an event saying the MSI was prevented from running and the administrator gets the message 'The system administrator has set policies to prevent this installation' despite the full network path of the MSI being whitelisted, and no other blocking rules are in the Windows Installer Applocker rules.

How did you do the whitelisting? As an exception on the deny rule?

[Sheridan]

In the msi rules I don't even have a deny, the deny rules are only on executables. I do have allow rules for msi and scripts to whitelist. Basically for the msi and script rules I generated the default set and then added a rule for admins to allow everything!

[Tefters]

Can you do us a screenshot of your GP settings for Applocker?

Also a simple check of all your GP's to make sure you don't accidentally have a 2nd GP somewhere with Applocker settings.

 

I use Applocker heavily here and apart from silly initial problems that took a 5 minute brain storm it works flawlessly.

 

EDIT: While I think about it have you also checked your group membership on whatever account your logging in with to ensure you don't cross over 2 groups between white list and deny permissions because deny will always win (EG. Deny Domain Users, Allow Domain Admins - Account is a member of both groups)

Edited June 7, 2016 by Tefters

[Sheridan]

I've checked everything I can think of so far. The PCs are all the same, in the same OU with only one Applocker policy applied to them. In all of the Applocker sections there is no Deny for anything other than Staff/Student groups, and then various Allows for Staff/Students for whitelisted apps & paths, and for domain admins as well.

 

One of the installers I try to run is a batch file that calls an msiexec installation with an MST file, this fails as soon as the msi tries to install. I've tried the reg patches above (and rebooted as well) and its still the same.

 

I've never found applocker consistent in the way deny is supposed to override allow, in the case of powershell even though it was set to Deny for Staff/Students the allow rule for the Windows\System folder overrode it, until I put an exception in the Allow rule!

[Sheridan]

This is getting weirder now! Our install package is on a server share - the msi is called by a batch file with a couple of parameters (\quiet etc)

 

If you run the batch file as Administrator, you get two messages logged in the event viewer.

1) \\SERVER\SHARE\INSTALL.BAT was allowed to run.

2) \\SERVER\SHARE\INSTALL.MSI was allowed to run.

 

But what happens is the batch file open and closes a command prompt very quickly.

 

If you try to run the msi directly (its not designed for that, but just for testing) you get the event logged:

 

\\SERVER\SHARE\INSTALL.MSI was prevented from running.

 

Now, if you disable UAC (or set it as low as you can in the gui) and then run the batch file (As Administrator) then it seems to work! So is it Applocker or that infernal UAC thats causing this! I've got UAC set to the MS defaults recommended.

[Arthur]

If you try to run the msi directly (it's not designed for that, but just for testing) you get the event logged:

 

\\SERVER\SHARE\INSTALL.MSI was prevented from running.

 

Now, if you disable UAC (or set it as low as you can in the gui) and then run the batch file (As Administrator) then it seems to work!

Are you double-clicking the MSI to install it or right-clicking the MSI and selecting "Run as Administrator"? If the former that could explain why it isn't working when you have UAC enabled because your Administrator account isn't an administrator account until it elevates.

[Tefters]

That's good old UAC mate not Applocker

[Sheridan]

Are you double-clicking the MSI to install it or right-clicking the MSI and selecting "Run as Administrator"? If the former that could explain why it isn't working when you have UAC enabled because your Administrator account isn't an administrator account until it elevates.

 

I can't get the 'Run as administrator' prompt to appear for the msi, only the batch file. I tried the registry fixes above and that seems to now allow the batch file to work, which simply runs "msiexec /i install.msi /quiet"

 

I've got UAC configured as per Microsofts recommended defaults, although I'd probably be better off disabling it completely but this breaks a few apps!

[Arthur]

I can't get the 'Run as administrator' prompt to appear for the msi, only the batch file.

Sorry, I meant "Install as administrator". You should see this after you have added the first lot of registry settings in post #2.

 

 

I've got UAC configured as per Microsoft's recommended defaults, although I'd probably be better off disabling it completely but this breaks a few apps!

Don't do that. That's not a good idea.

[Sheridan]

Hmm I'm still missing Install as Administrator even with the registry changes. I'll double check they've applied tomorrow. It does look like its UAC causing the problems rather than applocker. Having said that I'm not convinced applocker is doing exactly what I want, unlike SRP which worked very reliably.

[Sheridan]

Right, those registry fixes have had an effect - there seems to have also been an issue with these W10 PCs not picking up GPOs, or picking them up erractically. Running gpupdate sometimes gets an error about not being able to acces \\sysvol\policies\{policy guid} which seems to be a fairly common bug with 10.

 

The ones that work, pick up the registry fix and Install as Administrator appears and works! Now to fix the next bug...

 

Cheers for all the info folks!