diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 7657e480fa..a2776beaac 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -1,56 +1,50 @@ --- title: AppLocker policy use scenarios -description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. +description: This article for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # AppLocker policy use scenarios -> [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. -This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. +AppLocker can help you improve the management of application control and the maintenance of application control policies. Application control scenarios addressed by AppLocker include: -AppLocker can help you improve the management of application control and the maintenance of application control policies. Application control scenarios addressed by AppLocker can be categorized as follows: +1. **App inventory** -1. **App inventory** + AppLocker can apply its policy in an audit-only mode where all app access activity is collected in event logs for further analysis. Windows PowerShell cmdlets are also available to help you understand app usage and access. - AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is collected in event logs for further analysis. Windows PowerShell cmdlets are also available to help you understand app usage and access. +2. **Protection against unwanted software** -2. **Protection against unwanted software** + AppLocker can block apps from running simply by excluding them from the list of allowed apps per business group or user. Any app not allowed by your policy based on its publisher, installation path, or file hash, is blocked. - AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app isn't identified by its publisher, installation path, or file hash, the attempt to run the application fails. +3. **Licensing conformance** -3. **Licensing conformance** + With AppLocker's app inventory described earlier, you can identify the software that corresponds to your software licensing agreements and restrict application usage based on licensing agreements. - AppLocker can provide an inventory of software usage within your organization, so you can identify the software that corresponds to your software licensing agreements and restrict application usage based on licensing agreements. +4. **Software standardization** -4. **Software standardization** + AppLocker policies can allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. - AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. - -5. **Manageability improvement** - - AppLocker policies can be modified and deployed through your existing Group Policy infrastructure and can work in conjunction with policies created by using Software Restriction Policies. As you manage ongoing change in your support of a business group's apps, you can modify policies and use the AppLocker cmdlets to test the policies for the expected results. You can also design application control policies for situations in which users share computers. - -### Use scenarios +## Use scenarios The following are examples of scenarios in which AppLocker can be used: -- Your organization implements a policy to standardize the applications used within each business group, so you need to determine the expected usage compared to the actual usage. -- The security policy for application usage has changed, and you need to evaluate where and when those deployed apps are being accessed. -- Your organization's security policy dictates the use of only licensed software, so you need to determine which apps aren't licensed or prevent unauthorized users from running licensed software. -- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. -- Your organization needs to restrict the use of Universal Windows apps to just those apps your organization approves of or develops. -- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. -- The license to an app has been revoked or is expired in your organization, so you need to prevent it from being used by everyone. -- A new app or a new version of an app is deployed, and you need to allow certain groups to use it. -- Specific software tools aren't allowed within the organization, or only specific users have access to those tools. -- A single user or small group of users needs to use a specific app that is denied for all others. -- Some computers in your organization are shared by people who have different software usage needs. -- In addition to other measures, you need to control the access to sensitive data through app usage. +- Your organization implements a policy to standardize the applications used within each business group, so you need to determine the expected usage compared to the actual usage. +- Your security policy for application usage changed, and you need to evaluate where and when those deployed apps are being accessed. +- Your organization's security policy dictates the use of only licensed software, so you need to determine which apps aren't licensed or prevent unauthorized users from running licensed software. +- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. +- Your organization needs to restrict the use of Universal Windows apps to just those apps your organization approves of or develops. +- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. +- The license to an app is revoked or expired in your organization, so you need to prevent it from being used by everyone. +- A new app or a new version of an app is deployed, and you need to allow certain groups to use it. +- Specific software tools aren't allowed within the organization, or only specific users have access to those tools. +- A single user or small group of users needs to use a specific app that is denied for all others. +- Some people who need access to different apps share computers in your organization. +- In addition to other measures, you need to control the access to sensitive data through app usage. + +## Related articles -## Related topics - [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md index 8f8b29113c..909445c4b9 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference.md @@ -1,30 +1,27 @@ --- title: AppLocker technical reference -description: This overview topic for IT professionals provides links to the topics in the technical reference. +description: This overview article for IT professionals provides links to the articles in the technical reference. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # AppLocker technical reference ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This overview topic for IT professionals provides links to the topics in the technical reference. -AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. +This overview article for IT professionals provides links to the articles in the technical reference. +AppLocker lets you create rules to allow or deny apps from running based on information about the apps' files. You can specify unique rules for different users or groups to control who can run those apps. ## In this section -| Topic | Description | -| - | - | -| [What Is AppLocker?](what-is-applocker.md) | This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. | -| [Requirements to use AppLocker](requirements-to-use-applocker.md) | This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. | -| [AppLocker policy use scenarios](applocker-policy-use-scenarios.md) | This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. | -| [How AppLocker works](how-applocker-works-techref.md) | This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. | -| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker's basic architecture and its major components. | -| [AppLocker processes and interactions](applocker-processes-and-interactions.md) | This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. | -| [AppLocker functions](applocker-functions.md) | This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. | -| [Security considerations for AppLocker](security-considerations-for-applocker.md) | This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. | -| [Tools to Use with AppLocker](tools-to-use-with-applocker.md) | This topic for the IT professional describes the tools available to create and administer AppLocker policies. | -| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | +| Article | Description | +| --- | --- | +| [What Is AppLocker?](what-is-applocker.md) | This article for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. | +| [Requirements to use AppLocker](requirements-to-use-applocker.md) | This article for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. | +| [AppLocker policy use scenarios](applocker-policy-use-scenarios.md) | This article for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. | +| [How AppLocker works](how-applocker-works-techref.md) | This article for the IT professional provides links to articles about AppLocker architecture and components, processes and interactions, rules and policies. | +| [AppLocker architecture and components](applocker-architecture-and-components.md) | This article for IT professional describes AppLocker's basic architecture and its major components. | +| [AppLocker processes and interactions](applocker-processes-and-interactions.md) | This article for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. | +| [AppLocker functions](applocker-functions.md) | This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. | +| [Security considerations for AppLocker](security-considerations-for-applocker.md) | This article for the IT professional describes the security considerations you need to address when implementing AppLocker. | +| [Tools to Use with AppLocker](tools-to-use-with-applocker.md) | This article for the IT professional describes the tools available to create and administer AppLocker policies. | +| [AppLocker Settings](applocker-settings.md) | This article for the IT professional lists the settings used by AppLocker. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md index eb422a3a03..9ad52b4cd3 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md @@ -1,44 +1,42 @@ --- title: Configure the AppLocker reference device -description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. +description: This article for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Configure the AppLocker reference device ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. +This article for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. An AppLocker reference device that is used for the development and deployment of AppLocker policies should mimic the directory structure and corresponding applications in the organizational unit (OU) or business group for the production environment. On a reference device, you can: -- Maintain an application list for each business group. -- Develop AppLocker policies by creating individual rules or by creating a policy by automatically generating rules. -- Create the default rules to allow the Windows system files to run properly. -- Run tests and analyze the event logs to determine the effect of the policies that you intend to deploy. +- Maintain an application list for each business group. +- Develop AppLocker policies by creating individual rules or by creating a policy by automatically generating rules. +- Create the default rules to allow the Windows system files to run properly. +- Run tests and analyze the event logs to determine the effect of the policies that you intend to deploy. The reference device doesn't need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). ->**Warning:** Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. - -**To configure a reference device** +> [!WARNING] +> Don't use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies won't work as expected. -1. If the operating system isn't already installed, install one of the supported editions of Windows on the device. +## To configure a reference device - >**Note:** If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device - -2. Configure the administrator account. +1. If the operating system isn't already installed, install one of the supported editions of Windows on the device. - To update local policies, you must be a member of the local Administrators group. To update domain policies, you must be a member of the Domain Admins group or have been delegated privileges to use Group Policy to update a Group Policy Object (GPO). + >**Note:** If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device. -3. Install all apps that run in the targeted business group or OU by using the same directory structure. +2. Configure the administrator account. + + To update local policies, you must be a member of the local Administrators group. To update domain policies, you must be a member of the Domain Admins group or have delegated privileges to use Group Policy to update a Group Policy Object (GPO). + +3. Install all apps that run in the targeted business group or OU by using the same directory structure. The reference device should be configured to mimic the structure of your production environment. It depends on having the same apps in the same directories to accurately create the rules. ### See also -- After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this task, see [Working with AppLocker rules](working-with-applocker-rules.md). -- [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) +- After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this task, see [Working with AppLocker rules](working-with-applocker-rules.md). +- [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index a654dfc5f7..56fef83f74 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -1,31 +1,29 @@ --- title: Find digitally signed apps on a reference device -description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. +description: This article for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Determine which apps are digitally signed on a reference device ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. +This article for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. The Windows PowerShell cmdlet **Get-AppLockerFileInformation** can be used to determine which apps installed on your reference devices are digitally signed. Perform the following steps on each reference computer that you used to define the AppLocker policy. The device doesn't need to be joined to the domain. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -**To determine which apps are digitally signed on a reference device** -1. Run **Get-AppLockerFileInformation** with the appropriate parameters. +## To determine which apps are digitally signed on a reference device - The **Get-AppLockerFileInformation** cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that aren't signed don't have any publisher information. +1. Run **Get-AppLockerFileInformation** with the appropriate parameters. -2. Analyze the publisher's name and digital signature status from the output of the command. + The **Get-AppLockerFileInformation** cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log might not contain all of these fields. Files that aren't signed don't have any publisher information. + +2. Analyze the publisher's name and digital signature status from the output of the command. For command parameters, syntax, and examples, see [Get-AppLockerFileInformation](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee460961(v=technet.10)). -## Related topics +## Related articles - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md index 5d2b189772..3d5dcd1008 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker.md @@ -1,61 +1,43 @@ --- title: Requirements to use AppLocker -description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. +description: This article for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Requirements to use AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. +This article for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ## General requirements To use AppLocker, you need: -- A device running a supported operating system to create the rules. The computer can be a domain controller. -- For Group Policy deployment, at least one device with the Group Policy Management Console (GPMC) or Remote Server Administration Tools (RSAT) installed to host the AppLocker rules. -- Devices running a supported operating system to enforce the AppLocker rules that you create. +- A device running a supported operating system to create the rules. The computer can be a domain controller. +- For Group Policy deployment, at least one device with the Group Policy Management Console (GPMC) or Remote Server Administration Tools (RSAT) installed to host the AppLocker rules. +- Devices running a supported operating system to enforce the AppLocker rules that you create. >[!NOTE] ->As of [KB 5024351](https://support.microsoft.com/help/5024351), Windows 10 versions 2004 and newer and all Windows 11 versions no longer require a specific edition of Windows to enforce AppLocker policies - +>As of [KB 5024351](https://support.microsoft.com/help/5024351), Windows 10 versions 2004 and newer and all Windows 11 versions no longer require a specific edition of Windows to enforce AppLocker policies. + ## Operating system requirements The following table shows the Windows versions on which AppLocker features are supported. | Version | Can be configured | Can be enforced | Available rules | Notes | -| - | - | - | - | - | -| Windows 10 and Windows 11| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

Windows versions older than version 2004, including Windows Server 2019:
| -| Windows Server 2019
Windows Server 2016
Windows Server 2012 R2
Windows Server 2012| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | -| Windows 8.1 Pro| Yes| No| N/A|| -| Windows 8.1 Enterprise| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | -| Windows RT 8.1| No| No| N/A|| -| Windows 8 Pro| Yes| No| N/A|| -| Windows 8 Enterprise| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL|| -| Windows RT| No| No| N/A| | -| Windows Server 2008 R2 Standard| Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows 7 Ultimate| Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows 7 Enterprise| Yes| Yes| Executable
Windows Installer
Script
DLL| Packaged app rules won't be enforced.| -| Windows 7 Professional| Yes| No| Executable
Windows Installer
Script
DLL| No AppLocker rules are enforced.| - +| --- | --- | --- | --- | --- | +| Windows 10 and Windows 11 | Yes | Yes | Packaged apps
Executable
Windows Installer
Script
DLL | Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

Windows versions older than version 2004, including Windows Server 2019:
| +| Windows Server 2019
Windows Server 2016
Windows Server 2012 R2 | Yes | Yes | Packaged apps
Executable
Windows Installer
Script
DLL| | +| Windows 8.1 Pro | Yes | No | N/A | | +| Windows 8.1 Enterprise | Yes | Yes | Packaged apps
Executable
Windows Installer
Script
DLL | | -AppLocker isn't supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature isn't supported on the above operating systems. - ->[!NOTE] ->You can use Software Restriction Policies with AppLocker, but with some limitations. For more info, see [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md). +AppLocker isn't supported on versions of the Windows operating system not listed in the preceding table. ## See also + - [Administer AppLocker](administer-applocker.md) - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - [Optimize AppLocker performance](optimize-applocker-performance.md) -- [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) - [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) - [AppLocker Design Guide](applocker-policies-design-guide.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md index e976eb85b8..256c416dbf 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md @@ -1,68 +1,31 @@ --- title: What Is AppLocker -description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. +description: This article for the IT professional describes what AppLocker is. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # What Is AppLocker? ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article for the IT professional describes what AppLocker is. -This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. +Windows includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. For information to help you choose when to use WDAC or AppLocker, see [WDAC and AppLocker overview](/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview). -AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. +AppLocker helps you create rules to allow or deny apps from running based on information about the apps' files. You can also use AppLocker to control which users or groups can run those apps. Using AppLocker, you can: -- Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). -- Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. -- Assign a rule to a security group or an individual user. -- Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe). -- Use audit-only mode to deploy the policy and understand its impact before enforcing it. -- Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. -- Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. - -AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved apps +- Control the following types of apps and files: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). +- Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. +- Assign a rule to a security group or an individual user. +- Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe). +- Use audit-only mode to deploy the policy and understand its effect before enforcing it. +- Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. +- Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. For information about the application control scenarios that AppLocker addresses, see [AppLocker policy use scenarios](applocker-policy-use-scenarios.md). -## What features are different between Software Restriction Policies and AppLocker? - -**Feature differences** - -The following table compares AppLocker to Software Restriction Policies. - -|Feature|Software Restriction Policies|AppLocker| -|--- |--- |--- | -|Rule scope|All users|Specific user or group| -|Rule conditions provided|File hash, path, certificate, registry path, and Internet zone|File hash, path, and publisher| -|Rule types provided|Defined by the security levels:
  • Disallowed
  • Basic User
  • Unrestricted|Allow and deny| -|Default rule action|Unrestricted|Implicit deny| -|Audit-only mode|No|Yes| -|Wizard to create multiple rules at one time|No|Yes| -|Policy import or export|No|Yes| -|Rule collection|No|Yes| -|Windows PowerShell support|No|Yes| -|Custom error messages|No|Yes| - -Application control function differences - -The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. - -|Application control function|SRP|AppLocker| -|--- |--- |--- | -|Operating system scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to those supported operating system versions and editions listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). But these systems can also use SRP.
    **Note:** Use different GPOs for SRP and AppLocker rules.
    | -|User support|SRP allows users to install applications as an administrator.|AppLocker policies are maintained through Group Policy, and only the administrator of the device can update an AppLocker policy.

    AppLocker permits customization of error messages to direct users to a Web page for help.| -|Policy maintenance|SRP policies are updated by using the Local Security Policy snap-in or the Group Policy Management Console (GPMC).|AppLocker policies are updated by using the Local Security Policy snap-in or the GPMC.

    AppLocker supports a small set of PowerShell cmdlets to aid in administration and maintenance.| -|Policy management infrastructure|To manage SRP policies, SRP uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.|To manage AppLocker policies, AppLocker uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.| -|Block malicious scripts|Rules for blocking malicious scripts prevent all scripts associated with the Windows Script Host from running, except those scripts that are digitally signed by your organization.|AppLocker rules can control the following file formats: .ps1, .bat, .cmd, .vbs, and .js. In addition, you can set exceptions to allow specific files to run.| -|Manage software installation|SRP can prevent all Windows Installer packages from installing. It allows .msi files that are digitally signed by your organization to be installed.|The Windows Installer rule collection is a set of rules created for Windows Installer file types (.mst, .msi and .msp) to allow you to control the installation of files on client computers and servers.| -|Manage all software on the computer|All software is managed in one rule set. By default, the policy for managing all software on a device disallows all software on the user's device, except software that is installed in the Windows folder, Program Files folder, or subfolders.|Unlike SRP, each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection will be allowed to run. This configuration makes it easier for administrators to determine what will occur when an AppLocker rule is applied.| -|Different policies for different users|Rules are applied uniformly to all users on a particular device.|On a device that is shared by multiple users, an administrator can specify the groups of users who can access the installed software. An administrator uses AppLocker to specify the user to whom a specific rule should apply.| - -## Related topics +## Related articles - [AppLocker technical reference](applocker-technical-reference.md)