Applocker and Visual Studio

[OllieC]

Hi everyone,

 

Scratching my head about this at the moment.

 

We use visual studio quite extensively; all of our year 9 do a unit writing VB and then all CS year 10/11/12/13 use it.

 

Recently implemented AppLocker and I'm really trying to avoid path rules, especially in user-writable areas. I'm currently having to set a path rule in their documents folders to allow them to run their projects.

 

I've been told it's possible to sign projects and create a publisher rule in AppLocker for this but I'm stuck on how to achieve this.

 

So far I've set up the code signing template in our Windows Certificate Authority and got it autoenrolling for students. In an active Visual Studio project, if I go to the project properties and Signing, I can select the signing certificate from the certificate store but the executable wizard in applocker doesn't let me chose any of the debug executables to grab publisher information.

 

Is this actually possible? Is there somewhere else that I should be signing projects?

 

There has to be a decent way of doing this without using a path rule!

 

TIA

[free780]

Is the exe actually signed? you can use Get-Authenticode cmdlet to prove it. I wanted to do this but instead moved to OneDrive and rely on defender screening executables. Otherwise you need a seperate VM and a way of sharing files both ways.

[OllieC]

No it's not signing; I'm wondering if there's somewhere else that signing should be configured for a project. I've been assured it is doable somehow but the person that's done it has long since forgotten.

 

VM solution is very much an over-my-dead-body scenario. It strikes me as absurd if there's no sensible way of doing this without the added overhead of needing a VM.

[SpaceInvader83]

No it's not signing; I'm wondering if there's somewhere else that signing should be configured for a project. I've been assured it is doable somehow but the person that's done it has long since forgotten.

 

VM solution is very much an over-my-dead-body scenario. It strikes me as absurd if there's no sensible way of doing this without the added overhead of needing a VM.

Did you ever get signing working in this way so you could whitelist in applocker? We are in an almost identical situation , currently with a path rule for the students who do programming but I loathe having this in place and equally the VM route is something I'd like to avoid.