patracles

Thank you for confirming my suspicions, I had a feeling I wasn't the only other person experiencing this. I'll have to investigate SRP, I was under the impression that Applocker was the latest/greatest and it seemed quite simple to implement (which it was) but sadly it looks like another feature that is half-baked for Win10.

Sorry, I spaced out momentarily on the audit mode. No need for that since I am doing testing in a specific testing OU and we don't have anyone using Windows 10 yet. I'm wondering if this has something to do with the Application Identity service - all the Microsoft docs note that this service should be set to Automatic startup within the GPO that your Applocker policy is in. In that other thread I originally mentioned, the person commented that they could get it to work if the AppID service was stopped when a new user logged in (which would be annoying to achieve), but I haven't even had success with that.

I have tried Enforcing, no change. I'm not sure what is meant by Audit. Thanks for your reply!

Bump... nobody else has seen this?

Trying to whip Win10 Enterprise into shape for our environment and just did my first Applocker policy (created the rules on a Win10 machine, exported and imported into my policy on our domain controllers). It worked mostly as expected. On the account of which the policy was created, I get "application blocked by your administrator" message when clicking on a live tile of a blocked application. On subsequent new user profiles, I see a different behavior - the tile just gets grayed out when it is clicked on, no message or anything. Subsequent log-out/log-ins, the app will be "lit up" again until it is clicked and becomes gray. The only thread I can find on this is here: https://social.technet.microsoft.com/Forums/windows/en-US/93c4a45b-6b5c-42ee-8285-e6c855bec59b/windows-10-applocker-issues-not-displaying-the-warning-this-app-has-been-blocked-by-your-system?forum=win10itprosetup . I was under the impression that subsequent logins wouldn't even SEE the blocked applications, but not to get even the blocked message is just worthless. Anyone seen this before?