Applocker unreliable in applying rules

[Sheridan]

Anyone else finding applocker a bit unreliable in applying rules in W10? I'm used to SRP being rock solid in W7 but I can't put any faith in applocker

 

Example - new crappy ('educational') software runs an exe from the users temp folder - so I whitelist the .exe in Applocker for Staff and administrators. Works for admins, blocked for staff. Even logs an event saying its blocked for staff and allowed for an admin despite the rules allowing it for both groups!

 

I'm going to just strip out applocker and stick with SRP in W10 until I can rely on it

[jamesrhart]

Have you checked your other rules for Staff? In AppLocker a Deny takes precedence over an allow.

[Sheridan]

Yeah - we have quite simple rules in place and there's nothing that denies that path. Move of our rules were ported over from SRP (duplicated as it requires groups based rules). It has been a bit hit and miss since we started with W10 but I'm started to feel like SRP is the better option.

[jamesrhart]

That's odd as despite our frustration with whitelisting (unable to whitelist a specific PowerShell script without allowing PowerShell for the world) it works quite well for us, but as you say SRP may be the better option in this case.

[Arthur]

Anyone else finding applocker a bit unreliable in applying rules in W10?

Nope. It's working fine for me.

 

so I whitelist the .exe in Applocker for Staff and administrators. Works for admins, blocked for staff.

Can you post more details on the "temp folder" rule(s) you have created for staff and admins?

 

For example, I have an AppLocker rule that allows executables to run from AppData that looks like this and it works fine in W7 & W10:

 

[b]Action[/b]: Deny
[b]Path[/b]: %OSDRIVE%\Users\*\AppData\*
[b]User or Group[/b]: AD group that contains all staff
[b]Exceptions[/b]: Publisher, Path or Hash rules of the applications you want to allow

[Sheridan]

I haven't been as specific as that - the file runs from :C\users\user\appdata\local and I've put an allow rule in for the program.exe without any path at all.

 

When a staff member runs it the log shows it was blocked by applocker, but an admin shows an allow rule. We don't have a deny rule that relates to that folder to override it either! Bizarre