Block .exe using Intune

[petben]

Has anyone had success blocking .exe using Intune? I want to prevent users running .exe from their user documents, download folder etc.

 

Any help with a process would be great.

[free780]

I’ve read about people deploying applocker via PowerShell within intune.

[petben]

After some research I’m going to try to create an app locker policy, export the xml and create an Intune policy.

 

I need to ensure the application identity service is running, can services be managed in Intune as a built in setting, or is that again require running a PS script to set this to started and automatic?

[jamesrhart]

I'm running AppLocker via Intune and we are blocking a fair number of things, including EXEs, but also PowerShell. The only issue with the latter is that it means we can't use Intune deployed Powershell scripts (running as the user). We run Win 10 Education and I don't remember having to do anything with services to get this working.

[petben]

Thanks jamesrhart, can you please say how you get it into Intune? I am going to follow something like this:

https://www.vansurksum.com/2020/02/24/a-guide-to-implementing-applocker-on-your-modern-workplace

 

If you can include a few screenshots that would be really helpful, what OMA-URI string do you use for the EXE rules?

 

Thanks

[petben]

Sorry one more thing, how do you stop Azure global admins (our IT logins) getting the Applocker policies, what group in Applocker do you exclude on the rules? Are they 'BUILTIN\administrators'? The local AD group 'Domain Admins' doesn't even sync to Azure.

 

 

Thanks

[jamesrhart]

I think that's a similar guide to the one that I used.

OMA-URI I am using is:

./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/WBS_APPLOCK_001/EXE/Policy

I can upload a new XML file to the same policy and it overrides the settings without having to redeploy or change the OMA-URI.

PM me if you want a quick Teams meeting to discuss. He mentions in his guide that you don't need to do anything with the service and it will automatically start (see near the bottom).

 

BUILTIN\Administrators is the one that you as Admins end up in, it's frustrating but you can't use any Azure AD or AD groups with the policies.

[petben]

Thanks, last thing (!) we have enabled the default .exe policies (which includes program files and Windows), cant really think what else they'd need, have you found that any other folders are important to be allowed for exes to run so users laptops can work properly?Appdata maybe?

[jamesrhart]

This is what we do (currently):

 

[petben]

thanks James, as AppLocker is a 'block by default, allow by exception' system, why have you specified e.g. Deny - %HOT%, unless that path is specifically allowed it's already denied..?

[jamesrhart]

We copied core rules from our existing AD set-up and I didn't see the sense in removing those in case it helps overrides and allow we've put in place for a publisher, ultimately it does no harm having them in there.

[petben]

agreed thanks, do you bother with Windows Installer rules?

[petben]

thanks James, all working now. thanks for the help.

[jamesrhart]

No worries