Applocker for intune?

[bolyki]

Hello,

 

This is my first post here. Could anyone tell me, or put me in the right direction, to set up:

 

Blocking executables opening from C:\Users\*\Downloads\

 

?

 

This needs to be done in Intune and not on prem, although I have access to on prem as well.

 

Thanks!

[bolyki]

I have resolved this and made a guide.

 

Applocker Intune impelemntation

 

 

Open local security policy

 

Navigate to Application Control Policies -> Applocker

 

In each: Executable rules, windows installer rules, script rules, packaged app rules right click, and create default rules.

 

This will create the standard, so nobody can install anything unless they are admin. Programs will only be executed from Program Files and Windows folder.

 

In executable rules, an extra security measure is to add a deny section to C:\Users\*\Downloads so nothing in the downloads folder will be executed as an extra layer.

 

Now to migrate this to Entra :

 

Right click Applocker and export it to .xml

 

From this xml we need to add two sections to Entra.

 

https://intune.microsoft.com/#home > devices > windows> config profiles> create new > platform win10 or later > type is templates and then select custom > create

 

Name it something, click next, add, name should be EXE, OMA-URI is:

 

./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/Native/EXE/Policy

 

Type: String

 

Value is a cut out of the .xml we exported. The section needed starts with after it. Like this:

 

 

 

 

Copy and paste this into the value in Intune and click save.

 

Add another one, name it Appx

 

OMA-URI : ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/Native/StoreApps/Policy

 

It is a string again and value is: The section needed starts with after it. Like this:

 

 

 

Click save, add the config to the relevant groups you want, sync up device and the check compliance if the policy has been assigned.