rdangleton

Digging up an old thread here, but thought I'd mention this in case anyone tries to do the above. The "Don't run specified Windows Applications" GPO is only based on the filename of the .exe in question, so it does not provide any real security. A user can copy cmd.exe or powershell.exe to any location and rename it to anything else and it will run normally. AppLocker is the only thing built into Windows that can analyze the hash of the executable and prevent it from running regardless of what it is named or where it is located.