[1703, cu] 1703 upgrade applocker fails

[ADMaster]

I upgraded my own machine today and discovered applocker not working.

I have checked on a few VMs too, a fresh install of 1703 and applocker works, an upgrade it does not.

Back on SRP I knew of a reg key I could delete that would reset it and get everything fresh from the GPO. I don’t know of anything like this for Applocker.

A gpresult does not show any errors and it has the correct version from ad / sysvol.

I moved my PC into another OU and forced a policy refresh and rebooted, moved it back rinse and repeat.

I am getting this in the event log

ID 8000

AppID policy conversion failed. Status The system cannot find the file specified.

I found a post were this same ID gave the message access denied, but system does have access to the TxR folder in my case.

The appidsvc is running.

What file is it looking for?

Can anyone else replicate this in their environment.

 

A couple other issues with the upgrade is sccm services remote control and task sequence are disabled. I have fixed those by configuring them to automatic start in GPO.

 

TIA

[ADMaster]

So today I thought I'd do a fresh image on a VM and run procmon to figure out what file is missing. However the fresh install has issues with applocker now.

The only thing I can conclude at this point is updating to the image I modified with ntlite broke something.

If anyone knows what I may have removed that broke applocker I'll give it another go. But I think I'll just go back to my scripts.

[arron]

I can't really help you much other than to say that our 1073 installs, fresh and upgrades, both have working applocker.

[3s-gtech]

Same here - my VM which acts as the main test bed for Windows 10 has been upgraded from 1511 to 1607 to 1703 and Applocker works.

[ADMaster]

Have either of you modified your wim with ntlite? I've done nothing but watch a VM reimage its self half a dozen times today.

I extracted a fresh copy from the iso and everything worked.

I modified a copy with ntlite and applocker failed.

I've attached my xml if you spot something I'm removing that I shouldn't.

Thankfuly only my PC and a couple admin staff got this version of the deployment so I'll test just redoing the upgrade TS with the corrected wim.

 

ntlite.txt

[ADMaster]

I reran the upgrade TS and it did not fix the issue. In hindsight I should have rolled back the upgrade, but now a rollback will just revert to the first run of the upgrade.

 

Any other ideas before I reimage to a fresh install?

[3s-gtech]

Not with nLite, no. Modified it with DISM when going to 1607 originally, the upgrade to 1703 was unmodified. I suspect nLite is stuffing it somehow. I know Applocker works on my clean 1703 installs (also modified with DISM) but sorry it's not a direct comparison.

[arron]

You could try moving the computer to an OU with applocker disabled and then back again. It might reset it maybe.