Intermittent issue with applocker and MS programs

[cgilmour]

Hi,

we have the following applocker allow rules in our server's GPO

 

%OSDRIVE%\Program Files\*

%OSDRIVE%\Program Files (x86)\*

 

they are both executable (path) rules and allowed for everyone

 

but intermittently, apparently randomly, the odd computer in the school gets applocker blocking any Microsoft office program e.g. word, excel, IE etc.

 

the error in the logs is e.g. %OSDRIVE%\PROGRA~1\INTERNET EXPLORER\IEXPLORE.EXE was prevented from running. the error always seems to involve %OSDRIVE and the string PROGR~1.

 

After a reboot, the computer is fine but a gpupdate /force doesn't clear the issue.

 

Any ideas appreciated on what's causing this in the first place ?.

 

Regards

chris

[Arthur]

%OSDRIVE%\Program Files\*

%OSDRIVE%\Program Files (x86)\*

Try deleting both of those path rules and replace them with this (which covers both folders)...

 

%PROGRAMFILES%\*

[free780]

I had this. Try not use the everyone group. Use students, staff or domain users.

[cgilmour]

Many thanks for the replies will try first thing tomorrow

Cheers

Chris

[Duke5A]

Hi,

we have the following applocker allow rules in our server's GPO

 

%OSDRIVE%\Program Files\*

%OSDRIVE%\Program Files (x86)\*

 

they are both executable (path) rules and allowed for everyone

 

but intermittently, apparently randomly, the odd computer in the school gets applocker blocking any Microsoft office program e.g. word, excel, IE etc.

 

the error in the logs is e.g. %OSDRIVE%\PROGRA~1\INTERNET EXPLORER\IEXPLORE.EXE was prevented from running. the error always seems to involve %OSDRIVE and the string PROGR~1.

 

After a reboot, the computer is fine but a gpupdate /force doesn't clear the issue.

 

Any ideas appreciated on what's causing this in the first place ?.

 

Regards

chris

 

In the group policy editor if you right-click in the App Locker Executable Rules section one of the options is to create the default rules. Do this and the defaults will allow all executables in program files and the windows directories.