[1703, cu] Windows 10 1703 - no "blocked" message from Applocker

[patracles]

Trying to whip Win10 Enterprise into shape for our environment and just did my first Applocker policy (created the rules on a Win10 machine, exported and imported into my policy on our domain controllers). It worked mostly as expected. On the account of which the policy was created, I get "application blocked by your administrator" message when clicking on a live tile of a blocked application. On subsequent new user profiles, I see a different behavior - the tile just gets grayed out when it is clicked on, no message or anything. Subsequent log-out/log-ins, the app will be "lit up" again until it is clicked and becomes gray. The only thread I can find on this is here: https://social.technet.microsoft.com/Forums/windows/en-US/93c4a45b-6b5c-42ee-8285-e6c855bec59b/windows-10-applocker-issues-not-displaying-the-warning-this-app-has-been-blocked-by-your-system?forum=win10itprosetup . I was under the impression that subsequent logins wouldn't even SEE the blocked applications, but not to get even the blocked message is just worthless. Anyone seen this before?

[patracles]

Bump... nobody else has seen this?

[Mr_Jiminy]

Have you set the ACP to Audit or Enforced?

[patracles]

I have tried Enforcing, no change. I'm not sure what is meant by Audit. Thanks for your reply!

[patracles]

Sorry, I spaced out momentarily on the audit mode. No need for that since I am doing testing in a specific testing OU and we don't have anyone using Windows 10 yet. I'm wondering if this has something to do with the Application Identity service - all the Microsoft docs note that this service should be set to Automatic startup within the GPO that your Applocker policy is in. In that other thread I originally mentioned, the person commented that they could get it to work if the AppID service was stopped when a new user logged in (which would be annoying to achieve), but I haven't even had success with that.

[Sheridan]

We've used Applocker on 10 for a little while, and no messages have appeared for blocked applications. Its something we gave up on and continue using SRP instead.

[patracles]

Thank you for confirming my suspicions, I had a feeling I wasn't the only other person experiencing this. I'll have to investigate SRP, I was under the impression that Applocker was the latest/greatest and it seemed quite simple to implement (which it was) but sadly it looks like another feature that is half-baked for Win10.