Applocker and Start Menu

[MrMuppet]

I've been battling with Applocker for a while now and figure it's time I ask for some help.

Background:

So I created an applocker policy for Windows 10 (LTSB) to prevent students from running internet browsers on their exam accounts (I also set the security filtering of the GPO to only apply to students on the exam security group, but it decided to apply across the board for some reason). I setup the policy with the default rules and included deny rules for Internet Explorer and Firefox. This worked all fine and dandy, however a short while later I get a call from our ICT department saying none of the students can open their visual studio programs (they could open the project but not the exe's they created). I tried including the path to their home folders (where all the project files are created) as an allow rule but didn't work. As it's unlikely the students signed their exe's I figured I'd remove the default rule about only allowing signed Microsoft exe's and this got them working again (feel free to slap me up-side the head on this one, turns out by default Applocker denies all programs and packed apps unless you have these default rules, who'd-a thunk it!). As you can probably guess, the next day disaster strikes and no one can login. Disabling this policy and re-booting the machines got them logging in again, however here's where the real issue beings.

The Problem:

The Start Menu, Notification bar, sound bar and Time & Date panel no longer work. Right click works to get the context menus up, but left click literally does nothing.

What I've tried so far:

- Enabling the Applocker policy, removing all entries and clearing out the policy, then gpupdate on the affected machines. This has fixed some but there are a few machines still unable to open the start menu and no amount of gpupdates and re-boots fixes it.

- Removed a machine from the domain, removed all group policies from the registry and re-booted, still no dice.

- Removed all the applocker files from C:\WINDOWS\System32\AppLocker and re-booted.

- Took the applocker files and Start Menu tile database from a working machine and copied them to an affected machine, still nothing.

- Removed all locally cached profiles and created new local admin account, still the same problem even on the new account.

- Ran DISM and SFC multiple times, both report there's nothing wrong.

- Checked the App Identity service, it wasn't running so I started it, did another gpupdate (laptop was back on domain at this point) and re-booted.

- Checked again and the App ID service was set to manual but I couldn't change it, get access denied; so I set a policy to make it automatic start but it's still set to manual. In-fact, any change I try and make to this service gives me an access denied error. Can make changes to other services no problem.

 

I've checked through event viewer and it shows under the "EXE and DLL" log that the Applocker policy is being applied. However under the Packaged App Deployment and Execution logs, the last entries were on the 18th Nov, shortly before I made this new Applocker policy, and these only say wether an app was allowed to run or not. There is another interesting entry in Event viewer, however it doesn't give me much actual information; in the "Microsoft-Windows-TWinUI/Operational" log there are many 105 entries that start with "The description for Event ID 105 from source Microsoft-Windows-Immersive-Shell cannot be found" and goes on to say the component could be corrupt. As I understand it the "Immersive-Shell" is basically the Metro UI. So it's clearly trying to tell me something, it just doesn't know what it's trying to tell me.

 

My guess is that the Applocker service is being denied access when it tries to update whatever it needs to in order to fully remove this policy.

 

So my question is: Without doing a repair install/re-image, how can I reset/restore the Applocker service to it's default state? Failing that, how can I get the Start Menu and Notification Centre working again?

Edited December 6, 2016 by MrMuppet

[jertsy]

I've been battling with Applocker for a while now and figure it's time I ask for some help.

Background:

So I created an applocker policy for Windows 10 (LTSB) to prevent students from running internet browsers on their exam accounts (I also set the security filtering of the GPO to only apply to students on the exam security group, but it decided to apply across the board for some reason). I setup the policy with the default rules and included deny rules for Internet Explorer and Firefox. This worked all fine and dandy, however a short while later I get a call from our ICT department saying none of the students can open their visual studio programs (they could open the project but not the exe's they created). I tried including the path to their home folders (where all the project files are created) as an allow rule but didn't work. As it's unlikely the students signed their exe's I figured I'd remove the default rule about only allowing signed Microsoft exe's and this got them working again (feel free to slap me up-side the head on this one, turns out by default Applocker denies all programs and packed apps unless you have these default rules, who'd-a thunk it!). As you can probably guess, the next day disaster strikes and no one can login. Disabling this policy and re-booting the machines got them logging in again, however here's where the real issue beings.

The Problem:

The Start Menu, Notification bar, sound bar and Time & Date panel no longer work. Right click works to get the context menus up, but left click literally does nothing.

What I've tried so far:

- Enabling the Applocker policy, removing all entries and clearing out the policy, then gpupdate on the affected machines. This has fixed some but there are a few machines still unable to open the start menu and no amount of gpupdates and re-boots fixes it.

- Removed a machine from the domain, removed all group policies from the registry and re-booted, still no dice.

- Removed all the applocker files from C:\WINDOWS\System32\AppLocker and re-booted.

- Took the applocker files and Start Menu tile database from a working machine and copied them to an affected machine, still nothing.

- Removed all locally cached profiles and created new local admin account, still the same problem even on the new account.

- Ran DISM and SFC multiple times, both report there's nothing wrong.

- Checked the App Identity service, it wasn't running so I started it, did another gpupdate (laptop was back on domain at this point) and re-booted.

- Checked again and the App ID service was set to manual but I couldn't change it, get access denied; so I set a policy to make it automatic start but it's still set to manual. In-fact, any change I try and make to this service gives me an access denied error. Can make changes to other services no problem.

 

I've checked through event viewer and it shows under the "EXE and DLL" log that the Applocker policy is being applied. However under the Packaged App Deployment and Execution logs, the last entries were on the 18th Nov, shortly before I made this new Applocker policy, and these only say wether an app was allowed to run or not. There is another interesting entry in Event viewer, however it doesn't give me much actual information; in the "Microsoft-Windows-TWinUI/Operational" log there are many 105 entries that start with "The description for Event ID 105 from source Microsoft-Windows-Immersive-Shell cannot be found" and goes on to say the component could be corrupt. As I understand it the "Immersive-Shell" is basically the Metro UI. So it's clearly trying to tell me something, it just doesn't know what it's trying to tell me.

 

My guess is that the Applocker service is being denied access when it tries to update whatever it needs to in order to fully remove this policy.

 

So my question is: Without doing a repair install/re-image, how can I reset/restore the Applocker service to it's default state? Failing that, how can I get the Start Menu and Notification Centre working again?

 

I have found that Applocker does not gracefully remove from the desktops when the policy is removed, even if you have the removal behaviour set correctly in the GPO. I have an issue where the only way I can see to truly get rid of the applocker settings is a rebuild. I might add that mine is windows 7 as I havent started deploying 10 yet.

[MrMuppet]

Yeah it seems Windows 10 isn't yet free this either. I'd like to avoid a re-build if at all possible but I may just have to accept we need to re-build half of the college...again.

[jertsy]

Yeah it seems Windows 10 isn't yet free this either. I'd like to avoid a re-build if at all possible but I may just have to accept we need to re-build half of the college...again.

 

Thats a stinger, I have just finished my testing so its only affecting a couple of stations but now I know it needs to be right first time to avoid rebuilding half the site if I have to remove Applocker, so a gradual rollout is called for. It is annoying.

[MrMuppet]

Aye 'tis a real pain. My advice, if you're using Applocker, don't remove any of the default rules . Either that or move away from Applocker entirely and use the registry to deny specific exe's; however that won't work for packaged apps like the windows store but at least it's easily reversible.

[MrMuppet]

*Bump*

 

Anyone have any ideas?

[kennysarmy]

I'm guessing this was no help:

 

https://technet.microsoft.com/en-us/library/hh310286(v=ws.10).aspx

[MrMuppet]

Yeah that was one of the first things I tried I'm afraid. However I do think that what that article describes is basically what issue is, just not as simple a fix. I can stop and start the App Locker service no problem, but if I try and make any changes to it's settings (setting from Manual to Automatic for example) I get an access denied error.

 

Correct me if I'm wrong I think where it's falling over is the App Locker service isn't being started when the PC boots up so isn't applying any of the new settings. Also, manually starting the service then running gpupdate doesn't make a difference.