I need to block the "Radeon Software" via GPO

[chazzy2501]

Not sure how to stop the radeon software dashboard that is installed automatically with the graphics driver. I don't wish Pupils to use it (esp, as it has it's own web browser in it and can launch software!)

 

I also hope that the win+r (Radeon Overlay) can be disabled via gpo as well. This is part of the drivers so hopefully don't louse up the graphics driver!

 

 

(I'm thinking software restriction policy) is it a store program or exe?!?

 

note: I didn't install the driver it was fetched by Windows.

Edited May 14, 2021 by chazzy2501

[robyholmes]

AppLocker would be the best tool for this, and you gain additional security out of using it as well. Especially in these times of ransomware!

[3s-gtech]

You should be able to remove this as a startup entry which then disables the background capabilities. That'll need a registry tweak which can be deployed with GP.

[chazzy2501]

applocker is being a pain and will not allow me to extract the publisher information from any exe I drag out of the appx folder.

 

every exe I present it with state that the file is not valid... so software restrictions it is. I'll block the directory.

[jthompson]

AppLocker is the best way to achieve this, but if you're not already using it, you'll want to do some testing first to make sure you have all the rules needed for all of your software. The default rules will cover stuff in Windows dir and Program Files, but apps, installers or scripts being run from other locations will need rules adding.

SRP can be used quick and dirty with a default rule of unrestricted (akak SRP in blacklist mode) and then a blocking rule just for the Radeon utility. Not recommended long term (work towards AppLocker instead) but it'll work right away without risking interfering with anything else. Set SRP under Computer Config in Group Policy.

Another option is to modify the permissions on the exe file to deny your students from reading it. A computer startup script with a icacls command in it could do that.

[round2it]

Gpo to block the exe running?

 

Its a user policy

Policy

System from memory

[free780]

Remove-AppxProvisionedPackage

 

On a powershell sctipt per machine?

 

You may need to do

 

Get-AppxProvisionedPackage to find the app.

[Cache]

applocker is being a pain and will not allow me to extract the publisher information from any exe I drag out of the appx folder.

 

every exe I present it with state that the file is not valid... so software restrictions it is. I'll block the directory.

 

In Applocker there's a seperate section for Apps - are you trying to put it in there or the normal exe bit?

[chrisakak9]

2nd for app locker.

you may also be able to block it with your AV too I know sophos has the the ability.

 

another quick dirty way would be to add a task kill command for the running application to the login script.

taskkill /IM applicationname.exe /f

 

another alternative I have done in the past when building the images is to install the driver using the inf files rather that the full software package. but this would clear need to be part of the image Build.

[Arthur]

applocker is being a pain and will not allow me to extract the publisher information from any exe I drag out of the appx folder.

Like @Cache mentioned you need to use a Publisher rule for packaged apps. An EXE rule won't work for AppXs because they're not EXEs.

[chazzy2501]

cheers people, I got confused because the file is called radeonsoftware.exe but SRP can't stop it from running. I've enable AppLocker with default rules. (in audit mode) to see what happens. I can't see how to add an appx that isn't installed on my local PC.

 

C:\Program Files\WindowsApps\AdvancedMicroDevicesInc-2.AMDRadeonSoftware_10.20.10027.0_x64__0a9344xs7nr4m\radeonsoftware\radeonsoftware.exe

 

this is the file, I can't run it manually and SRP can't stop it?!

 

So package app rules is appx right? (how do I add a package that isn't installed locally?)

 

Also Do I have to start the appx service on my PCs?

 

cheers

[jthompson]

(how do I add a package that isn't installed locally?)

 

On a machine that does have the app installed, run Local Security Policy and navigate to Security Settings > Application Control Policies > AppLocker > Packaged app Rules. Go through the motions of adding a rule using an installed app as a reference. Pick the app you want to block. Instead of actually creating the rule, just copy the Publisher/Package/Version details out to a txt file and exit back out of Local Security Policy.

 

In Group Policy, start setting up your new rule, but pick any available app as a reference to begin with. Then tick the "Use custom values" option and replace the Publisher/Package/Version details with the ones that you copied earlier.

[chazzy2501]

Thanks @jthompson it hadn't occurred to me to just use local GPO for testing.

 

The following all local:

 

I still can't stop it from running, I've used applocker turned on enforcement, chosen the appx from the list, deny everyone.... and it still runs!?

 

rebooted and tried as a non-admin still runs. added the exe to the exe deny (using applocker rather than SRP) still runs!?

 

am I missing a step. (I started application identity service in case, no change)

[jthompson]

Is AppLocker working otherwise? It'd perhaps be worth seeing if you can successfully block some other packaged apps or regular exes within Program Files using AppLocker, just as a test. I've used the method above to successfully block the Calc app (20H2) for certain user groups. Edited May 17, 2021 by jthompson

[jthompson]

Thanks @jthompson it hadn't occurred to me to just use local GPO for testing.

 

The following all local:

 

I still can't stop it from running, I've used applocker turned on enforcement, chosen the appx from the list, deny everyone.... and it still runs!?

 

rebooted and tried as a non-admin still runs. added the exe to the exe deny (using applocker rather than SRP) still runs!?

 

am I missing a step. (I started application identity service in case, no change)

 

I'm not sure that AppLocker as configured in Local Security Policy will affect domain user accounts. Have you tried it against a local non-domain non-admin user?

[chazzy2501]

ah no I didn't try a local account. and I'll try and block the calc! Thanks for the tips.

[jthompson]

I may be wrong about the local vs domain thing, but if you've got AppLocker configured in a GPO that's applying the machine you're testing on, some of its settings might be taking precedence over your local test policy equivalents.

[chazzy2501]

ok, AppLocker doesn't seem to function for any user. I tried blocking calc and it just kept popping up. I created a local user but no change. check enforcement and it was on. This is a headscratcher.

 

oh, I'm using Windows 10 Education. (which has the feature)

[chazzy2501]

ok, doing via group policy, using calc as a base to put in the custom fields and using publisher "CN=0A0B0503-04C2-4CCF-9BC2-4F164DC80FEE" phew! it works..

 

Thanks everyone I was going to get peed off.

[Cache]

The applocker event logs in event viewer are extremely helpful and useful in determining things, they can be chatty but that's partly what makes them useful also

[RLR]

Anyone looking to use App Locker for all their machines should look at Aaron Locker . Does most of the work for you as long as you have a reference image or can access other machines. I found another post elsewhere on how to set up applocker forwarding events to centralize them all in one place.

[KK20]

just remember that removing an applocker policy does not necessarily affect existing profiles. You may need to head to https://en.it-pirate.eu/windows-10-applocker-policies-still-affect-disabling-service/ and look at "option 3"

 

However, applocker is good and once you get used to it, it can be powerful.

[chazzy2501]

ok, why with no changes has this policy stopped working? Where are the event logs and will it show me why it has stopped blocking the publisher? Grumble factor 110%!

[jthompson]

AppLocker events on the client should be in Event Viewer > Applications and Services Logs > Miscrosoft > Windows > AppLocker. That will log whenever something is allowed to run, but probably not give you musch more detail than that. I don't know if the Application Identity Service needs to be running in order for those events to be logged at all, but probably worth checking whether that service is/was running at the time.

[jthompson]

Actually, having said that , the "Details" tab of each event will show you the corresponding rule name from your AppLocker policy. That ought to help you zero in on why a particular exe is being allowed to run.