Applocker - Dialogue box query

[CHiLL]

This is a weird query - I am after the executable file that pushes the applocker blocked notification popup to the user. When a user launches an app that is restricted by AppLocker, how is the popup that is dusplayed pushed?

 

The reason is because I'm finding that our Impero remote viewing is crashing/losing connection whenever the AppLocker "This app has been blocked by your system administrator" message is displayed, requiring me to close the remote window and reopen to view/control the machine. Impero's response is to add AppLocker to the Impero exclusion list of monitored applications, however I'm not sure this is how AppLocker works, I don't think there is an executable, as it's a set of rules against the machine.

 

I have attempted to save the tasklist log of running processes on the machine, both while the popup is shown and while it's not, but unfortunately it doesn't show any difference.

Edited July 21, 2023 by Dos_Box

[jthompson]

AppLocker rules will be being enforced by the Application Identity service, and I suspect it'll all be tucked away at a pretty low level inside the OS. The nearest you might get to an exe or dll for it (or for the dialogue) might just be some very general purpose stuff like svchost.exe.

 

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions

 

That dialogue seems to shade the rest of the screen, a bit like how a UAC prompt does. I know that UAC prompts sometimes interrupt certain remote access tools, as it's someting happened above the current user session (or something).

[mavhc]

After I added every executable to the Impero exclusion list it's been much more stable

[Steve21]

Have you checked your UAC elevation settings? Just wondering if for normal users you have it set to request credentials etc (which would hit the UAC "screen" and disconnect remote which sounds like what you mentioned and this wouldn't then work trying to bypass the injection), compared to having it auto deny elevation requests etc

 

Or as an easy test if you don't want to change that, set it to use "interactive desktop" via GPO/local GP on a test machine instead of secure and test to see if it still disconnects when the apps blocked

 

Steve

[CHiLL]

This doesn't happen on Windows 10 clients, only on Windows 11. I was hoping this would be a generic Windows question, rather than an Impero specific query, hence why I put it in this section. If it needs moving, I guess a mod would need to move it to the Impero direct support forum (though I do have a case open with them regarding this issue).

[mavhc]

Try setting exclusions to *, see if that fixes it