Applocker block CMD/PowerShell but allow scripts via GPO logon-scripts

[bicky]

Hi,

We have applocker policy with following rules.

 

EXE:

Allow - Builtin\Administrator - Default Rule All files

Allow - Everyone - Default Rule All files located in the Program folder

Allow - Everyone - Default Rule All files located in the Windows folder

Allow - Everyone - \\domain\SYSVOL\*

Allow - Everyone - \\domain\NETLOGON\*

Allow - Everyone - \\dc-0*.domain\SYSVOL\*

Allow - Everyone - \\dc-0*.domain\NETLOGON\*

Deny - Staff/Students - %WINDIR%\regedit.exe

Deny - Staff/Students - %SYSTEM32%\cmd.exe

Deny - Staff/Students - %SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe

Deny - Staff/Students - %SYSTEM32%\WindowsPowerShell\v1.0\powershell_ise.exe

 

 

SCRIPTS:

Allow - Builtin\Administrator - Default Rule All scripts

Allow - Everyone - Default Rule All scriptslocated in the Program folder

Allow - Everyone - \\domain\SYSVOL\*

Allow - Everyone - \\domain\NETLOGON\*

Allow - Everyone - \\dc-0*.domain\SYSVOL\*

Allow - Everyone - \\dc-0*.domain\NETLOGON\*

 

 

None of the .bat/PS1 scripts applied via GPO logon-scripts runs. I also have one .VBS script which runs fine.

System event log says: Logon script failed - Script name: logon.bat

Applocker event log says: %SYSTEM32%\CMD.EXE was prevented from running.

 

 

How do you guys block access to the CMD/PowerShell but allow GPO logon scripts, any help on this would be much appreciated, thank you.

[dfergusson]

Have you tried doing this using User GPO instead of Applocker?

 

Administration, System, Enable "Prevent Access to command prompt" No to "Disable the command prompt script processing also?"

and under the same location "don't run specified Windows Applications" and add powershell.exe & powershell_ise.exe

Edited August 9, 2018 by dfergusson

[jessica]

Did you ever find a way to block powershell but allow logon powershell scripts to run?

[bicky]

I couldn't do with the App-locker so used the way dfergusson suggested.

[Areku]

I'm not 100% but shouldn't the locations be double wild-carded?

 

like \\dc-0*.domain\SYSVOL\*\*

 

?

[rdangleton]

Digging up an old thread here, but thought I'd mention this in case anyone tries to do the above. The "Don't run specified Windows Applications" GPO is only based on the filename of the .exe in question, so it does not provide any real security. A user can copy cmd.exe or powershell.exe to any location and rename it to anything else and it will run normally. AppLocker is the only thing built into Windows that can analyze the hash of the executable and prevent it from running regardless of what it is named or where it is located.

[free780]

Don't run specified Windows Applications also does not stop processes launched from command line. Only File Explorer.

If you do need Powershell login scripts running in the User Context you can sign them with a certificate and then add a certificate rule for scripts in your AppLocker Policy.

Ideally you want the PowerShell Execution Policy to AllSigned .

Restrict who can get a code signing certificate.