Apps which install to AppData - how to allow

[SteveB_NI]

Working on our new Win7 Image I'm trying to pre-install 2 programs - both of which run through AppData\Local\Programs\ so are by default blocked.

 

Is there anyway of allowing a specific program to be unblocked by name, but for every user account?

 

For example the path required is: C:\Users\testuseraccount\AppData\Local\Programs\Thonny\thonny.exe but I need it to be accessible to all accounts.

 

Tried to allow path %AppData%\Local\Programs\Thonny\thonny.exe but that made no difference - still blocked. Unless I right click and run as Admin - which standard users can't do obviously.

 

Thanks in advance!

[PeterH]

Assume you're talking about software restriction policies, so you could do this by creating a hash rule for thonny.exe rather than a path rule. This will allow the exe to run from anywhere. If you do that, do keep in mind that if the exe is upgraded at some point in the future to a new version, the file hash will be different, so you will need to re-create the rule.

[SteveB_NI]

Assume you're talking about software restriction policies, so you could do this by creating a hash rule for thonny.exe rather than a path rule. This will allow the exe to run from anywhere. If you do that, do keep in mind that if the exe is upgraded at some point in the future to a new version, the file hash will be different, so you will need to re-create the rule.

 

Thanks for this - yes it is Software restriction policies.

 

I have tried creating a local test policy for it via gpedit.msc & pointed it to Thonny.exe within Default user but unfortunately it's still blocked - a message comes up saying the program is unable to be started correctly.

 

[3s-gtech]

Tried pushing out the install folder to C:\Program Files (x86) instead, by copying the files to a deployment share and using GPP? I've found some software that loves using AppData (e.g. Spotify) can be poked back into Program Files and then works fine, for all users. Just doesn't update is all.

[SteveB_NI]

Tried pushing out the install folder to C:\Program Files (x86) instead, by copying the files to a deployment share and using GPP? I've found some software that loves using AppData (e.g. Spotify) can be poked back into Program Files and then works fine, for all users. Just doesn't update is all.

 

Tried to move it into Program Files (x86) and it is still blocked despite a GP hash & path rule, except for when I right-click run as admin. Same issue when I copy it onto a Shared area.

 

Must write to some temp area which is locked down

[ADMaster]

Is it signed? I'd try a publisher rule if it is. This will also allow it to run from anywhere, and hopefully catching anything else in temp areas that are getting blocked.

[PeterH]

You need to determine what is blocking it. If a software restriction policy is blocking it then it will be logged in the application event log and you can see it in event viewer. It will say something like 'Access to your.exe has been restricted by your administrator by the default software restriction policy'. If you don't see any such events in your log then you can stop looking at software restriction policies as this is not the issue. However if it does look like a software restriction policy is blocking it, then there are some advanced logging options that might help to troubleshoot it: https://technet.microsoft.com/en-us/library/hh994586(v=ws.11).aspx

 

Failing that, you would need to use something like Process Monitor (https://docs.microsoft.com/en-gb/sysinternals/downloads/procmon) to see what the app is trying to do. Probably attempting to write to the filesystem or registry somewhere the user doesn't have permission. If it fails straight away when it is started, it should be fairly easy to spot.