Prevent user opening locally-installed application

[enjay]

Exam season coming up again, and we're using laptops in a way we haven't done previously - this means I now need to block certain local applications (Word, Excel, Calculator). I knew how to do this back in the CC3 days, but haven't had to do it since going native (as it were!). Can anyone help?

[Steve21]

Generally we do it one of two ways. If it's small numbers we just don't install word/excel etc as easier to lock down that way

 

if it's lots or things like calc just use a normal SRP/applocker policy and block them directly

 

Steve

[enjay]

Generally we do it one of two ways. If it's small numbers we just don't install word/excel etc as easier to lock down that way

 

Not an option, as these are mainstream PCs when not being used for exams.

 

if it's lots or things like calc just use a normal SRP/applocker policy and block them directly

 

Thank you. Applocker looks like what I'm after, thanks.

[RLR]

Have you tried exam write pad software: http://www.edugeek.net/forums/educational-software/184116-exam-writepad-new-version-2-0-8-9-a-14.html

 

It's free and easy to setup to run from a shared network location. We've been using it for a couple of years. It's a very basic word processing piece of software which is updated frequently by the developer. The software can be setup to run in full screen mode and have it so the software can't be closed without a password. This means students can't do anything on the machine until the software is closed. It also has an auto save feature.

[enjay]

Thanks. Not relevant though, as we want to start using Read & Write instead of human readers in exams.

[enjay]

So, do I just create a GPO which has the relevant settings then apply it to the relevant OU, or do I need to do something else?

[Steve21]

Personally it depends how much you want to block.

 

If for example it's just word/calc I'd go with SRP policy, and apply it to the users OU and filter it to their group etc. Then all you need to do is put the paths you wanted blocked etc

 

Steve

[enjay]

Ah, hadn't realised they were different. I'd assumed Applocker is what replaced SRPs. Microsoft recommend using Applocker on Windows 7 upwards, but I don't actually see why.

 

SRPs are slightly "safer" as they block a specified app but allow everything else in the background to run unaffected, whereas Applocker blocks everything unless permitted, yes?

[Steve21]

Basically yes, SRP is blocklist, Applocker is whitelist. (So applocker is safer in regards to real security, but more likely to break stuff by accident )

 

However nowadays you have to use applocker for 10 etc as it manages MetroApps etc (if you want full lockdowns), but 7 wise SRP is easier especially for mini things

 

Steve

[enjay]

Thanks. I'll go with an SRP in this instance, as I need a quick win so don't want to spend time troubleshooting what I've accidentally blocked with Applocker. I'll make a note for the summer break to spend some time with Applocker, as we'll be going Win10 in the summer.

[ADMaster]

Ah, hadn't realised they were different. I'd assumed Applocker is what replaced SRPs. Microsoft recommend using Applocker on Windows 7 upwards, but I don't actually see why.

 

SRPs are slightly "safer" as they block a specified app but allow everything else in the background to run unaffected, whereas Applocker blocks everything unless permitted, yes?

Not entirely true.

SRP can be configured for a white or black list approach.

Applocker should be able to do a blacklist approach too. I've not tested this as I have a white list.

However create a rule that allows everything for everyone, then add your deny rules.

deny rules trump allowed rules.

Applocker can also be configured with user groups, so you could deny word to just an AD group of test takers.

 

Another idea, but I have no experience with... the new windows 10 test mode.

[Arthur]

Basically yes, SRP is blocklist, Applocker is whitelist.

SRPs are slightly "safer" as they block a specified app but allow everything else in the background to run unaffected, whereas Applocker blocks everything unless permitted, yes?

Nope! That's not correct.

 

Like @ADMaster mentioned, you can use AppLocker in either whitelist or blacklist modes (although most people choose the whitelist approach). Rule exceptions are then used to deny or allow respectively.

 

http://dfir-blog.com/2016/01/03/protecting-windows-networks-applocker/

 

Basically, there are two approaches to AppLocker – you either block everything and only allow certain stuff (whitelist) or you allow everything and block only certain stuff (blacklist).

 

Here is whitelist:

 

 

Here is blacklist:

 

 

There isn't any reason to use SRP these days.

 

https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

 

AppLocker enhances the functionality of the older Software Restriction Policies (SRP) feature. SRP was originally designed for Windows XP and Windows Server 2003. AppLocker differs from SRP by utilizing the Windows kernel to enforce the policy, improving the certificate rules for digitally signed software, and creating an audit mode to test the policy prior to enforcement.

[Steve21]

Nope! That's not correct.

 

Like @ADMaster mentioned, you can use AppLocker in either whitelist or blacklist modes (although most people choose the whitelist approach). Rule exceptions are then used to deny or allow respectively.

 

Which is then a block list As step one to make SRP work that way is block everything! Compared to Applockers block all by default, (Thus the "basically" )

 

Steve

Edited February 21, 2018 by Steve21

[Arthur]

As step one to make SRP work that way is block everything! Compared to Applockers block all by default,

To make Applocker work in blacklist mode you wouldn't use any of the default rules.

 

Try creating a single EXE rule that allows everything (using *) and then in the exceptions for that rule deny an EXE like "C:\Windows\System32\calc.exe". You should find that all other EXEs still run.

[Steve21]

I'm talking about SRP as above As if you do it that way Applocker would override any other policies in place and allow them all to run too.

 

Applocker doesn't even work with 7/8.1 Pro etc remember, so without knowing what setup he's got seemed easier to use something that will deffo work

 

I stick by my above that SRP is the way to go if blocking single apps for certain users as it can apply per user rather than faffing about creating per computer settings

 

Steve

Edited February 21, 2018 by Steve21

[Rob_D]

For a less technical approach: We just take away all the desktop and start menu shortcuts. Paired with the "no right click" GPO (sorry, I can't remember its proper name) and no C:\ drive access, this seems to work for most things.

[enjay]

Applocker doesn't even work with 7/8.1 Pro etc remember, so without knowing what setup he's got seemed easier to use something that will deffo work

 

Applocker works with 7 Enterprise, apparently.

 

I've created the restrictions in SRP and they work, although it does seem I could also have done it with Applocker pretty much as easily, I would just have needed a few default rules to allow C:\Program Files, C:\Windows and so on, then "trump" those with my deny rules on the specific applications.

 

Thanks everyone, really helpful. I'll leave my SRPs in place now since they work (and are needed for next week!) and will look at Applocker some more at leisure, as I'll need that for the exams next year by which point we'll be on Win10 and SRPs won't work any more.

[Steve21]

Applocker works with 7 Enterprise, apparently.

 

Ent yes, Pro no As it's not deemed needed for professionals!

 

At least you got it all sorted

 

Steve

[enjay]

For a less technical approach: We just take away all the desktop and start menu shortcuts. Paired with the "no right click" GPO (sorry, I can't remember its proper name) and no C:\ drive access, this seems to work for most things.

 

No right-click would annoy me really quickly! No idea if the students would notice or not, unsure how they typically copy and paste.

[Rob_D]

No right-click would annoy me really quickly! No idea if the students would notice or not, unsure how they typically copy and paste.

 

We've always disabled it four student accounts so they don't really know any different.

[ADMaster]

I'm glad you got it sorted, I'll just leave a bit more applocker planning advice here for your migration.

The default allow rules of program files windows etc cover most things with out breaking stuff.

The 3 gotcha areas are...

Programs that install in c:\appname we have 2 or 3 so needed to allow those.

Programs that install into the user profile like gotomeeting webex etc, allow these via certificate / publisher rules.

logon scripts. I have my entries listed several times just to be sure.

\\domainfqdn\netlog\*
\\domainfqdn\sysvol\*
\\dc01\netlogon\*
\\dc01\sysvol\*
\\dc02\netlogon\*
\\dc02\sysvol\*

 

It may be overkill but I didn't want my scripts breaking.