Applocker unreliable results

[Sheridan]

Anyone finding Applocker rather unreliable in 10?

 

For example, the Edu version of 10 comes with Skype Preview (of course, why wouldn't you want that with Edu!) and the dism commands to remove it leave it on the menu.

 

So, I thought I'll just stop it running, when they start it it create the processes SkypeApp.exe and SkypeHost.exe - both of these are blocked in Applocker but still run.

 

Looking at the Applocker logs, it says the Microsoft.SkypeApp was allowed to run - so whats the point of having executable rules if it ignore them?

 

Of course, I can't add the packaged app in Applocker as GPMC crashes when you browse the list - same bug from 1607 but I would have thought the executable rule will work anyway!

[atcoates]

Maybe Microsoft assume you've made a mistake by wanting to block one of their products so over rule you!

[kennysarmy]

I've found applocker always does what I expect I'm afraid....

 

Can you post up your policy?

[Sheridan]

Basically we have SkypeApp.exe and SkypeHost.exe as Blocked for Everyone (doesn't need to be everyone, but I was trying all ways!) in the Executable Rules.

 

As the Program Files folder has a default rule to allow, I also added both of those as Exceptions to that rule.

 

SRP was so reliable, applocker seems to be so variable I'm losing faith in it.

 

Checking the logs, it shows 'MICROSOFT.SKYPEAPP was allowed to run.' in the Packaged-App Execution log, and I can't put a rule in for those as MMC crashes out.

 

Does a Packaged App rule overrule a Executable rule I wonder?

Edited December 15, 2017 by Sheridan

[Sheridan]

LOL - Applocker just ignores what I put in!

 

It logs 'The AppLocker policy was applied successfully to this computer.' in which Skype is blocked as an executable, a packaged app and an exception to the allow rules and it still runs

 

Maybe your'e right, Microsoft ignore their own rules....

[3s-gtech]

I block lots of .exes from the Windows folder with Applocker, so I don't think so...

[sted]

have you checked the application identity service is running?

[kennysarmy]

Are you sure you don't have an allow rule that's superseding the deny?

 

Please post up your GPO settings so we can take a look.

[Sheridan]

I'll dump the gpo when I'm back in the office - we do have a default allow rule for packaged apps - but then specifically deny the ones we don't use/need.

[LemonEntry]

Microsoft.Skypeapp is not Skypeapp.exe and Skypehost.exe. Those are "Classic Desktop" applications, not Universal Windows Platform "apps".

 

Create a Packaged App Rule to deny "Skype - Microsoft.Skypeapp". It's separate from Executable rules but still found under AppLocker in Group Policy. I have several deny policies for social and gaming UWP apps located there, all working fine.

[Sheridan]

Microsoft.Skypeapp is not Skypeapp.exe and Skypehost.exe. Those are "Classic Desktop" applications, not Universal Windows Platform "apps".

 

Create a Packaged App Rule to deny "Skype - Microsoft.Skypeapp". It's separate from Executable rules but still found under AppLocker in Group Policy. I have several deny policies for social and gaming UWP apps located there, all working fine.

 

I've done both methods, executable and Packaged app rules. The skypeapp.exe and skypehost.exe run when you open the App (visible when checking the task list) so I thought at least one method would stop it from running!

[LemonEntry]

And GPResult shows the policy applies correctly? o_O

[Sheridan]

Oddly yes - both GRResult and the event viewer show the policy being applied - and the event viewer also logs that it was allowed to run!

[Sheridan]

And it also happens when trying to whitelist webex components - the path "%OSDRIVE%\PROGRAMDATA\WEBEX\*" is whitelisted for Everyone, but the event viewer logs the error "%OSDRIVE%\PROGRAMDATA\WEBEX\WEBEX\T31_TC\ATMGR.EXE was prevented from running" which contradicts itself!

 

I think I'll remove applocker and leave SRP on instead, that seems to work consistently.