Intune and blocking of Exe's

edubri · February 3

Hi all,

I've been having a lot of (non)fun trying to block exe's The education intune portal is able to stop powershell, cmd etc, I got ASR stopping most things other than exe's as there isnt anything there i can see that can stop exe's. I've tried a XML applocker in creating a policy ./Device/Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/EXE/Policy using this

<FilePathRule Id="11111111-1111-1111-1111-111111111111"
Name="Allow - Windows Folder (Everyone)"
Description="Baseline allow so Windows binaries run"
UserOrGroupSid="S-1-1-0"
Action="Allow">
<Conditions>
<FilePathCondition Path="%WINDIR%\*" />
</Conditions>
</FilePathRule>

<FilePathRule Id="22222222-2222-2222-2222-222222222222"
Name="Allow - Program Files (Everyone)"
Description="Baseline allow for 64-bit Program Files"
UserOrGroupSid="S-1-1-0"
Action="Allow">
<Conditions>
<FilePathCondition Path="%PROGRAMFILES%\*" />
</Conditions>
</FilePathRule>

<FilePathRule Id="33333333-3333-3333-3333-333333333333"
Name="Allow - Program Files (x86) (Everyone)"
Description="Baseline allow for 32-bit Program Files"
UserOrGroupSid="S-1-1-0"
Action="Allow">
<Conditions>
<FilePathCondition Path="C:\Program Files (x86)\*" />
</Conditions>
</FilePathRule>

<FilePathRule Id="44444444-4444-4444-4444-444444444444"
Name="Allow - Staff Desktop home.exe (Users)"
Description="Allows home.exe from the user's Desktop for Users group"
UserOrGroupSid="S-1-5-32-545"
Action="Allow">
<Conditions>
<FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" />
</Conditions>
</FilePathRule>

<FilePathRule Id="55555555-5555-5555-5555-555555555555"
Name="Allow - Staff Desktop Home.exe (Users)"
Description="Allows Home.exe from the user's Desktop for Users group"
UserOrGroupSid="S-1-5-32-545"
Action="Allow">
<Conditions>
<FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" />
</Conditions>
</FilePathRule>

<FilePathRule Id="66666666-6666-6666-6666-666666666666"
Name="Allow - All for Administrators"
Description="Full exemption for local Administrators"
UserOrGroupSid="S-1-5-32-544"
Action="Allow">
<Conditions>
<FilePathCondition Path="*" />
</Conditions>
</FilePathRule>

<FilePathRule Id="77777777-7777-7777-7777-777777777777"
Name="Deny - All for Users"
Description="Blocks all EXEs for Users unless explicitly allowed above"
UserOrGroupSid="S-1-5-32-545"
Action="Deny">
<Conditions>
<FilePathCondition Path="*" />
</Conditions>
</FilePathRule>

</RuleCollection>
</AppLockerPolicy>

I can't get this working in my test group /environment, am I missing something ? I want it to work simliar to the old group policy applocker

I get error code

-2016345596

Is there a better way in intune to achieve this ?

Thanks all

Edited February 3 by edubri

edubri · February 3

I may have had a lightbulb moment while writing this up - i think i need to push out the service to run - this could be it

altecsole · February 3

41 minutes ago, edubri said:

I may have had a lightbulb moment while writing this up - i think i need to push out the service to run - this could be it

Yes, the Application Identity service needs to be running for AppLocker rules to work.

edubri · March 9

No matter what I try I cant get the CSP for applocker working

I have got ASR rules running

I have the scripts blocked in Education portal

I just would like to block EXE's from running outside their usual locations like a group policy applocker or in Intune is it less of an issue?

The laptop is running applocker service

Its a Win 11 Education laptop

I've tried so many variants of the original XML script and I just cant get it to work. Has anyone had any luck with getting this working? Thanks

Ratcliffepg · March 9

If you configure the below they won't be able to run exe files

edubri · March 9

17 minutes ago, Ratcliffepg said:

If you configure the below they won't be able to run exe files

Thanks for this however it doesnt stop a user from copying an exe from USB, or network share or running a exe from downloads etc . What it does it blocks installing exe.msi software from the internet is this enough ? I think Applocker or something needs to be in place for this?

flipthebit · March 9

Can you block everything and create an allow list instead?

stevec_ · March 9

You only want the to copy the <RuleCollection> tags/contents in your XML file (i.e. not including the <AppLockerPolicy Version="1"> part). Save it in notepad as EXE.xml with UTF-8 encoding and upload it to your intune policy.

<RuleCollection Type="Exe" EnforcementMode="Enabled">

    <!-- Baseline allow: Windows folder for Everyone -->
    <FilePathRule Id="11111111-1111-1111-1111-111111111111"
                  Name="Allow - Windows Folder (Everyone)"
                  Description="Baseline allow so Windows binaries run"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%WINDIR%\*" />
      </Conditions>
    </FilePathRule>

    <!-- Baseline allow: Program Files (64-bit) for Everyone -->
    <FilePathRule Id="22222222-2222-2222-2222-222222222222"
                  Name="Allow - Program Files (Everyone)"
                  Description="Baseline allow for 64-bit Program Files"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%PROGRAMFILES%\*" />
      </Conditions>
    </FilePathRule>

    <!-- Baseline allow: Program Files (x86) for Everyone -->
    <FilePathRule Id="33333333-3333-3333-3333-333333333333"
                  Name="Allow - Program Files (x86) (Everyone)"
                  Description="Baseline allow for 32-bit Program Files"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="C:\Program Files (x86)\*" />
      </Conditions>
    </FilePathRule>

    <!-- Allow: %USERPROFILE%\Desktop\home.exe for Users -->
    <FilePathRule Id="44444444-4444-4444-4444-444444444444"
                  Name="Allow - Staff Desktop home.exe (Users)"
                  Description="Allows home.exe from the user's Desktop for Users group"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" />
      </Conditions>
    </FilePathRule>

    <!-- Allow: %USERPROFILE%\Desktop\Home.exe for Users -->
    <FilePathRule Id="55555555-5555-5555-5555-555555555555"
                  Name="Allow - Staff Desktop Home.exe (Users)"
                  Description="Allows Home.exe from the user's Desktop for Users group"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" />
      </Conditions>
    </FilePathRule>

    <!-- Admin exemption: allow EVERYTHING for local Administrators -->
    <FilePathRule Id="66666666-6666-6666-6666-666666666666"
                  Name="Allow - All for Administrators"
                  Description="Full exemption for local Administrators"
                  UserOrGroupSid="S-1-5-32-544"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>

    <!-- Global deny: EVERYTHING for Users (non-admins) -->
    <FilePathRule Id="77777777-7777-7777-7777-777777777777"
                  Name="Deny - All for Users"
                  Description="Blocks all EXEs for Users unless explicitly allowed above"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Deny">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>

  </RuleCollection>

This is what ours looks like after uploading:

Edited March 9 by stevec_

edubri · March 9

13 minutes ago, flipthebit said:

Can you block everything and create an allow list instead?

27 minutes ago, Ratcliffepg said:

If you configure the below they won't be able to run exe files

T

14 minutes ago, flipthebit said:

Can you block everything and create an allow list instead?

I guess i could but i think i would face same issue with XML being compatible with the appolocker CSP - its kinder driving me mad - Ive even tried a powershell app but that didn't work - If i had WDAC on the tenancy I feel it coudl be achieved that way

edubri · March 9

12 minutes ago, stevec_ said:

You only want the to copy the <RuleCollection> tags/contents in your XML file (e.g. not including the <AppLockerPolicy Version="1"> part). Save it in notepad as EXE.xml with UTF-8 encoding and upload it to your intune policy.

<RuleCollection Type="Exe" EnforcementMode="Enabled">

    <!-- Baseline allow: Windows folder for Everyone -->
    <FilePathRule Id="11111111-1111-1111-1111-111111111111"
                  Name="Allow - Windows Folder (Everyone)"
                  Description="Baseline allow so Windows binaries run"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%WINDIR%\*" />
      </Conditions>
    </FilePathRule>

    <!-- Baseline allow: Program Files (64-bit) for Everyone -->
    <FilePathRule Id="22222222-2222-2222-2222-222222222222"
                  Name="Allow - Program Files (Everyone)"
                  Description="Baseline allow for 64-bit Program Files"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%PROGRAMFILES%\*" />
      </Conditions>
    </FilePathRule>

    <!-- Baseline allow: Program Files (x86) for Everyone -->
    <FilePathRule Id="33333333-3333-3333-3333-333333333333"
                  Name="Allow - Program Files (x86) (Everyone)"
                  Description="Baseline allow for 32-bit Program Files"
                  UserOrGroupSid="S-1-1-0"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="C:\Program Files (x86)\*" />
      </Conditions>
    </FilePathRule>

    <!-- Allow: %USERPROFILE%\Desktop\home.exe for Users -->
    <FilePathRule Id="44444444-4444-4444-4444-444444444444"
                  Name="Allow - Staff Desktop home.exe (Users)"
                  Description="Allows home.exe from the user's Desktop for Users group"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" />
      </Conditions>
    </FilePathRule>

    <!-- Allow: %USERPROFILE%\Desktop\Home.exe for Users -->
    <FilePathRule Id="55555555-5555-5555-5555-555555555555"
                  Name="Allow - Staff Desktop Home.exe (Users)"
                  Description="Allows Home.exe from the user's Desktop for Users group"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" />
      </Conditions>
    </FilePathRule>

    <!-- Admin exemption: allow EVERYTHING for local Administrators -->
    <FilePathRule Id="66666666-6666-6666-6666-666666666666"
                  Name="Allow - All for Administrators"
                  Description="Full exemption for local Administrators"
                  UserOrGroupSid="S-1-5-32-544"
                  Action="Allow">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>

    <!-- Global deny: EVERYTHING for Users (non-admins) -->
    <FilePathRule Id="77777777-7777-7777-7777-777777777777"
                  Name="Deny - All for Users"
                  Description="Blocks all EXEs for Users unless explicitly allowed above"
                  UserOrGroupSid="S-1-5-32-545"
                  Action="Deny">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>

  </RuleCollection>

This is what ours looks like after uploading:

Thanks for this just trying this

tom_newton · March 9

I have always liked this: microsoft/AaronLocker: Robust and practical application control for Windows

edubri · March 10

Cheers everyone not able to look at this today - but im hoping i can get this working

edubri · March 12

Tried today I just cant seem to get it to work I get this error

and my latest xml is

</Conditions>

<Action>Allow</Action>

</FilePathRule>

</Conditions>

<Action>Allow</Action>

</FilePathRule>

</Conditions>

<Action>Allow</Action>

</FilePathRule>

</Conditions>

<Action>Allow</Action>

</FilePathRule>

</Conditions>

<Action>Allow</Action>

</FilePathRule>

</RuleCollection>

I've spent so much time trying to get this to work

The applocker service is running on my text client machine

The version of windows is 11 - Education

Is there anything I'm missing? other than my sanity lol

altecsole · March 12

Don't you need to wrap this in:

</AppLockerPolicy>

I've always configured on a test computer, then exported the XML.

edubri · March 12

16 minutes ago, altecsole said:

Don't you need to wrap this in:

<AppLockerPolicy Version="1">

</AppLockerPolicy>

I've always configured on a test computer, then exported the XML.

So for example my last xml post in here how should it look like ?

NicholasEsping · March 12

17 minutes ago, edubri said:

So for example my last xml post in here how should it look like ?

58 minutes ago, edubri said:

Tried today I just cant seem to get it to work I get this error

and my latest xml is

<RuleCollection Type="Exe" EnforcementMode="Enabled" Id="{A1B2C3D4-E5F6-47AA-8899-112233445566}">

<FilePathRule Id="{11111111-2222-3333-4444-555555555555}" Name="Allow Administrators All" Description="">

<UserOrGroupSid>S-1-5-32-544</UserOrGroupSid>

<Conditions>

<FilePathCondition Path="*" />

</Conditions>

<Action>Allow</Action>

</FilePathRule>

    <FilePathRule Id="{66666666-7777-8888-9999-AAAAAAAAAAAA}" Name="Allow Windows Directory" Description="">

<Conditions>

<FilePathCondition Path="%WINDIR%\*" />

</Conditions>

<Action>Allow</Action>

</FilePathRule>

    <FilePathRule Id="{BBBBBBBB-CCCC-DDDD-EEEE-FFFFFFFFFFFF}" Name="Allow Program Files" Description="">

<Conditions>

<FilePathCondition Path="%PROGRAMFILES%\*" />

</Conditions>

<Action>Allow</Action>

</FilePathRule>

    <FilePathRule Id="{12345678-90AB-CDEF-1234-567890ABCDEF}" Name="Allow Program Files x86" Description="">

<Conditions>

<FilePathCondition Path="%PROGRAMFILES(x86)%\*" />

</Conditions>

<Action>Allow</Action>

</FilePathRule>

    <FilePathRule Id="{ABCDEFAB-CDEF-ABCD-EFAB-CDEFABCDEFAB}" Name="Allow Homemode" Description="">

<Conditions>

<FilePathCondition Path="C:\ProgramData\Homemode\Homemode.exe" />

</Conditions>

<Action>Allow</Action>

</FilePathRule>

  </RuleCollection>

I've spent so much time trying to get this to work

The applocker service is running on my text client machine

The version of windows is 11 - Education

Is there anything I'm missing? other than my sanity lol

I use proactive remediation to update my managed installers for WDAC. This uses AppLocker so you should be able to modify this with your AppLocker policy if you have access to proactive remediations. You could also do this as a win32 application if you do not have access to remediations.

ne8801/scripts

altecsole · March 13

17 hours ago, edubri said:

So for example my last xml post in here how should it look like ?

Can I suggest that you use secpol.msc on a test computer. Ensure that the Application Identity service is running and configure your AppLocker rules in Audit mode until you are happy that they are working correctly. When you are, export the rules to XML and use in Intune.

Intune and blocking of Exe's

Recommended Posts

edubri

edubri

altecsole

edubri

Ratcliffepg

edubri

flipthebit

stevec_

edubri

edubri

tom_newton

edubri

edubri

altecsole

edubri

NicholasEsping

altecsole

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

Using Outlook email encryption with Office 365 A1

Senior ICT Technician - Clitheroe - £28,142FTE - Closes 23/09/26

UniFi U7 Outdoor - Feedback

altecsole

tom_newton

Home

Forums

What's New