Search the Community

Hi Guys, Wondering if anyone has experienced this. All PCS on the domain get this message upon bootup. Applying {FC491EF1-C4AA-4CE1-B329-414B101DB823} policy. The policy hangs for up to 3-4 mins depending on processor speed. I have used Event Viewer Group Policy event logs to narrow it down to the Applocker GPO. I can't see anything else on Event Viewer that suggests that the GPO timed out or if there is an error. This is the only GPO that takes quite a long time and as we have older PCS up to 10 years, this is having a performance impact upon computer startup. Would appreciate anyone's thoughts. Thank you, Jack

I'm running Win10 Education (the enterprise version) I have a set of laptops I wan't the store and its apps disabled on. I've set the "Computer Configuration > Administrative Templates > Windows Components > Store" disable the store and apps unfortunately the store is disabled but the apps still work. are these appx programs not considered store apps? (I've tried app locker but it keeps crashing when I use it) I want to disable the windows remote desktop (NOT mstsc, but the appx version with the same name) and windows mail specifically.

We are trying to prevent our users from running various commands that we don't specifically approve. We have implemented Applocker, but that doesn't prevent the user from running commands beginning with rundll32.exe or regsrv32.exe. In previous versions of Windows the group policy setting "Remove Run menu from Start Menu" was sufficient. But in Windows 10, when a user starts typing any command in search, even with that GP setting enforced, the command runs. Is there any way to prevent this? It is a significant security issue, and I am surprised that Windows 10, which is generally more secure, in this issue is actually less so. If not, is there at least a way I can prevent access to the search field? I've already found it on the task bar (even if I set it to "hidden", the user can switch it back to "show search icon" or "show search box"), in the alphabetical list of programs (under "Search") and via the Windows+S and Windows+Q hotkeys. I tried renaming the folder C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy That did disable the search function entirely, but it went too far for our needs. It would prevent the users from running their programs from the Start Menu. For example, they couldn't just start typing "Word" and have Microsoft Word open. Any ideas will be welcome. Thanks! David

I'm setting up a 1709 win 10 edu build for summer deployment. I'm using applocker for the first time (I've used SRP in the past) I've enabled the service created the default rules and set enforcement. One of the default install rules allows admin users to install from anywhere. This is not working as expected and blocks my domain admin user from installing programs from a network path. The error in the event log reads: "is not permitted software restriction policy" (but I have none set, checked gpresult) is that normal for an applocker events? I've redundantly added the network path as an allow rule for installers but this didn't help... [now deleted] the error 1007 "...only allows installation of unrestricted items..." "the authorization level returned....was 0x0"

This looks useful. Website / Download (free registration required)

We have implemented a GPO with Applocker configured. On the whole it is working just fine, allowing login scripts to run, blocking exe's from memory sticks etc. However we have 2 shares where we put programs that run from the network e.g. \\svr-app1\public\ \\svr-app2\public\networkprograms\ each of these shares has a mapped drive on the windows 7 client computers. (O:\ = \\svr-app1\public\, P:\ = \\svr-app2\public\) Try as I might, I cannot get a rule to allow executeables to run from either of these locations. I have created rules such as Allow Everyone O:\* Allow Everyone O:\*.* Allow Everyone O:\*\ Allow Everyone \\svr-app1\public\* Allow Everyone \\svr-app1\public\*.* Allow Everyone \\svr-app1\public\*\* but none of these work. When trying to run something we get an error like P:\VPLab9\VPLab9.exe This program is blocked by group policy, blah blah blah Anyone have any ideas what I am doing wrong? (looking at the event log, the program was blocked because it didnt match any rule)

Hello All, We're just about to try moving from the antiquated Software Restriction Policies to AppLocker to follow previous advise and best practice (we've had issues with SRP in the past so want to move away from it). Just after some advice/guidance and if anyone can send a screenshot of their basic config as a starting block that would be great. Also - do you apply 1 AppLocker GPO to all users, all computers (with it being a computer policy not user policy) - or do you just apply it to your Students / Staff groups etc? (currently using 1903 but working on a 1909 image to deploy soon if that makes any difference). Thanks for any advice.

Our progress with Windows 10 is going well. Its becoming obvious that you *must* block the Windows 10 settings App with Applocker. Its a shame more of the settings are not granular within a GPO for this as parts of it are quite useful. I've got it blocked for Students, but for Staff I've left it enabled and had a played around while using a test 'teacher' account. Just managed to execute a full reset of the PC! Machine is still chattering away sorting itself out. I believe our Staff won't do anything as silly as mess around with this, but wouldn't trust it with students. Must block! Pete

Afternoon all, Does anyone have any guidance, other than adding the verified publishers of all the memory sticks' encryption software to AppLocker? I have a few users who have brought in encrypted memory sticks only for them to find out they can't run the decryption/mapping tool due to AppLocker's restrictions. Is adding the file hash rule the only real way of enforcing this? Many thanks.

I've recently setup applocker for the exam accounts but as it has to work on every computer that could possibly be used and can't be enabled on a user basis...... anyway, it seems ok but I have one pupil who get a "restricted access" to her documents folder.. (not the big blue disallowed, you'd with an applocker violation) I would have this as a one off but another pupil said it happened to them as well. I'm getting a script error as well for all pupils but this does not seem to cause issues on the whole and I assume it is an old printer script. I'm wondering what mechanism maps the users profile from active directory "we use w:" and how I've broken it.

Anyone else having the same problem? Students needs to create exe's in small basic however this totally conflicts our app locker environment