Applocker - Publisher allow list

[petben]

Hello, I want to use applocker to restrict the users downloads folder. So not to block various legitimate webinar, remote support tools, remote access tools etc that will save to downloads I’m thinking to add allowed publishers. Has anyone got a useful list of allowed publishers that you wouldn’t mind sharing?

 

If anyone has any other tips for how to deal with areas of applocker - appx, dll, path restriction - Screenshots, exports even? That would be really useful as it’s a new system for us.

 

Thanks

[caffrey]

First thing you need to do is put applocker in audit mode and forward client applocker events to a collector - you'll get a good sense of what is being blocked then. It's also handy at giving you paths etc.

[JOrdan01070]

Hi this is the guide i used https://4sysops.com/archives/applocker-best-practices/

[RLR]

I would look into setting up applocker with aaron locker: https://github.com/microsoft/AaronLocker

 

Takes a bit of time to configure and get use to but well worth it.