Application Control - Using AppLocker

Application Control or AppLocker is a feature available since Windows 7 (new Windows 10 MDM API) that advances the features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny applications from running based on unique identities of files and to specify which users or groups can run those applications.

Using AppLocker, you can:

  • Control the following types of applications: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.msi and .msp), DLL files (.dll and .ocx), and packaged apps (.appx).
  • Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file.
  • Assign a rule to a security group or an individual user.
  • Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe).
  • Use audit-only mode to deploy the policy and understand its impact before enforcing it.
  • Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten.

AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved applications.

In Windows 10, AirWatch leverages the Application Control profile to send down the AppLocker configuration to devices. We will learn how to create the AppLocker configuration file to import into AirWatch.

1. Creating the AppLocker Configuration File

Creating the AppLocker Configuration File
  1. Click on the Windows logo
  2. Enter "group policy"
  3. Click Edit group policy

1.1. AppLocker GPO

AppLocker GPOZoom: AppLocker GPO
  1. Expand Windows Settings
  2. Expand Security Settings
  3. Expand Application Control Policies
  4. Expand AppLocker
  5. Click Configure rule enforcement

1.2. Enforce Packaged App Rules

Enforce Packaged App Rules

In this example we will block the Xbox application (.appx). If you wanted to block RegEdit then you would configure the Executable rules.

  1. Check Configured under Package app Rules; Enforce rules option is default, if you want to test the rules before applying them, then you could run them in Audit mode first.
  2. Click Apply
  3. Click OK

1.3. Create Default Rules

Create Default RulesZoom: Create Default Rules
  1. Click Packaged app Rules, to start configuring the rules.
  2. Right click in the white space to the right of the window
  3. Select Create Default Rules

1.4. Edit Default Rule

Edit Default Rule

For blacklisting only a few apps, I suggest starting with an Allow rule and add your blacklisting exceptions. If you want to only allow a few apps then convert the default to a Block and whitelist your exceptions.

  1. Right click on the default rule
  2. Click Properties

1.5. Exceptions

Exceptions
  1. Click Exceptions
  2. Click Add...

1.6. Packaged App Reference

Packaged App Reference
  1. Select Use an installed packaged as a reference
  2. Click Select...

1.7. Select Packaged Application

Select Packaged Application
  1. Using the scroll bar, scroll to the bottom
  2. Check the Xbox app with Package Name of Microsoft.XboxApp
  3. Click OK

1.8. Package Name

Package Name

All of the package's information is pre-populated. You can block the Xbox app based on the specific version, package name, or by the publisher. We want to block any version of the Xbox application.

  1. Raise the lever from Package version to Package name
  2. Click OK

1.9. Confirm Exceptions

Confirm Exceptions
  1. Click Apply
  2. Click OK

1.10. Export AppLocker Policy

Export AppLocker Policy
  1. Right click AppLocker
  2. Click Export Policy...

1.11. Save Policy XML

Save Policy XML
  1. Select the Downloads directory, if needed
  2. Enter "BlockXbox" in the File name field
  3. Click Save

1.12. Export Confirmation

Export Confirmation
  1. Click OK

1.13. Clear Policy

Clear Policy

Now that we have exported our policy, we want to remove it from our test device.

  1. Right click AppLocker
  2. Click Clear Policy

1.14. Clear Policy Confirmation

Clear Policy Confirmation
  1. Click Yes

1.15. Removed Policy Confirmation

Removed Policy Confirmation
  1. Click OK

1.16. Close Group Policy Editor

Close Group Policy Editor
  1. Click the X to close the Group Policy Editor window

2. Creating the Application Control Profile

Creating the Application Control Profile
  1. Back in the AirWatch console, click ADD
  2. Click Profile

2.1. Windows Platform

Windows Platform
  1. Click Windows

2.2. Windows Desktop Device Type

Windows Desktop Device Type
  1. Click Windows Desktop

2.3. General Profile Settings

General Profile SettingsZoom: General Profile Settings
  1. Enter "Block Xbox" into the Name field
  2. Select your "All Devices" smart group for the Assigned Groups

2.4. Application Control

Application Control
  1. Using the scroll bar, scroll all the way to the bottom
  2. Click Application Control
  3. Click Configure

2.5. Enable Application Control

Enable Application Control
  1. Check the Import Sample Device Configuration box
  2. Click Upload

2.6. Upload AppLocker Configuration XML

Upload AppLocker Configuration XML
  1. Click Browse...
  2. Ensure you are at the Downloads directory
  3. Click BlockXbox
  4. Click Open

2.7. Save AppLocker XML

Save AppLocker XML
  1. Click Save

2.8. Save & Publish

Save & Publish Zoom: Save & Publish
  1. Click Save & Publish

2.9. Device Assignment

Device AssignmentZoom: Device Assignment
  1. Click Publish

2.10. Verify Profile

Verify ProfileZoom: Verify Profile

You should now see your Block Xbox Application Control (AppLocker) profile. In this workshop, we did a simple blocking of one application. There are many resources which you can use to create your perfect AppLocker policy.