From ea99de589091bad0a8837b2c7dc76276a794748b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 11:25:16 -0400 Subject: [PATCH] Refresh applocker --- windows/security/docfx.json | 7 + ...ged-apps-to-existing-applocker-rule-set.md | 17 +-- .../applocker/administer-applocker.md | 17 +-- .../applocker-architecture-and-components.md | 17 +-- .../applocker/applocker-functions.md | 16 +-- .../applocker/applocker-overview.md | 128 +++++++----------- .../applocker-policies-deployment-guide.md | 15 +- .../applocker-policies-design-guide.md | 16 +-- .../applocker-policy-use-scenarios.md | 15 +- .../applocker-processes-and-interactions.md | 13 +- .../applocker/applocker-settings.md | 13 +- .../applocker-technical-reference.md | 17 +-- ...gure-an-applocker-policy-for-audit-only.md | 15 +- ...e-an-applocker-policy-for-enforce-rules.md | 15 +- ...figure-exceptions-for-an-applocker-rule.md | 15 +- ...onfigure-the-appLocker-reference-device.md | 19 +-- ...figure-the-application-identity-service.md | 15 +- .../create-a-rule-for-packaged-apps.md | 15 +- ...-a-rule-that-uses-a-file-hash-condition.md | 17 +-- ...reate-a-rule-that-uses-a-path-condition.md | 17 +-- ...-a-rule-that-uses-a-publisher-condition.md | 13 +- .../create-applocker-default-rules.md | 13 +- ...cations-deployed-to-each-business-group.md | 15 +- .../create-your-applocker-policies.md | 17 +-- .../applocker/create-your-applocker-rules.md | 15 +- .../applocker/delete-an-applocker-rule.md | 13 +- ...cies-by-using-the-enforce-rules-setting.md | 17 +-- ...oy-the-applocker-policy-into-production.md | 13 +- ...p-policy-structure-and-rule-enforcement.md | 15 +- ...igitally-signed-on-a-reference-computer.md | 15 +- ...ine-your-application-control-objectives.md | 17 +-- ...-users-try-to-run-a-blocked-application.md | 15 +- .../applocker/dll-rules-in-applocker.md | 13 +- ...tructure-and-applocker-rule-enforcement.md | 18 +-- .../document-your-application-list.md | 15 +- .../document-your-applocker-rules.md | 13 +- .../applocker/edit-an-applocker-policy.md | 29 ++-- .../applocker/edit-applocker-rules.md | 14 +- .../enable-the-dll-rule-collection.md | 15 +- .../applocker/enforce-applocker-rules.md | 18 +-- .../executable-rules-in-applocker.md | 13 +- .../export-an-applocker-policy-from-a-gpo.md | 15 +- ...port-an-applocker-policy-to-an-xml-file.md | 13 +- .../applocker/how-applocker-works-techref.md | 13 +- ...-applocker-policy-from-another-computer.md | 15 +- .../import-an-applocker-policy-into-a-gpo.md | 17 +-- .../applocker/maintain-applocker-policies.md | 18 +-- .../manage-packaged-apps-with-applocker.md | 29 ++-- ...r-policies-by-using-set-applockerpolicy.md | 15 +- .../merge-applocker-policies-manually.md | 13 +- ...onitor-application-usage-with-applocker.md | 17 +-- .../optimize-applocker-performance.md | 15 +- ...ckaged-app-installer-rules-in-applocker.md | 15 +- .../plan-for-applocker-policy-management.md | 18 +-- .../applocker/refresh-an-applocker-policy.md | 19 +-- ...ements-for-deploying-applocker-policies.md | 13 +- .../requirements-to-use-applocker.md | 37 ++--- ...the-automatically-generate-rules-wizard.md | 15 +- .../applocker/script-rules-in-applocker.md | 13 +- .../security-considerations-for-applocker.md | 19 +-- .../select-types-of-rules-to-create.md | 13 +- ...er-policy-by-using-test-applockerpolicy.md | 21 +-- .../test-and-update-an-applocker-policy.md | 17 +-- .../applocker/tools-to-use-with-applocker.md | 15 +- ...derstand-applocker-enforcement-settings.md | 13 +- ...stand-applocker-policy-design-decisions.md | 18 +-- ...ent-setting-inheritance-in-group-policy.md | 15 +- ...the-applocker-policy-deployment-process.md | 15 +- ...plocker-allow-and-deny-actions-on-rules.md | 15 +- .../understanding-applocker-default-rules.md | 13 +- .../understanding-applocker-rule-behavior.md | 17 +-- ...nderstanding-applocker-rule-collections.md | 16 +-- ...standing-applocker-rule-condition-types.md | 19 +-- ...understanding-applocker-rule-exceptions.md | 13 +- ...e-file-hash-rule-condition-in-applocker.md | 13 +- ...ng-the-path-rule-condition-in-applocker.md | 14 +- ...e-publisher-rule-condition-in-applocker.md | 17 +-- ...-create-and-maintain-applocker-policies.md | 23 +--- ...restriction-policies-in-the-same-domain.md | 20 +-- ...he-applocker-windows-powershell-cmdlets.md | 17 +-- .../using-event-viewer-with-applocker.md | 14 +- ...riction-policies-and-applocker-policies.md | 25 +--- .../applocker/what-is-applocker.md | 15 +- .../windows-installer-rules-in-applocker.md | 15 +- .../working-with-applocker-policies.md | 16 +-- .../applocker/working-with-applocker-rules.md | 25 +--- 86 files changed, 259 insertions(+), 1249 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index e079c36962..829d50a638 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -98,6 +98,13 @@ "operating-system-security/network-security/windows-firewall/*.yml": "nganguly" }, "appliesto": { + "threat-protection/windows-defender-application-control/applocker/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], "application-security/application-isolation/windows-sandbox/**/*.md": [ "✅ Windows 11", "✅ Windows 10" diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index 0400b53abf..0af1870a2a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -1,17 +1,12 @@ --- -title: Add rules for packaged apps to existing AppLocker rule-set +title: Add rules for packaged apps to existing AppLocker rule-set description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). -ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Add rules for packaged apps to existing AppLocker rule-set -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,6 +21,4 @@ This topic for IT professionals describes how to update your existing AppLocker You can create packaged app rules for the computers running Windows Server 2012 or Windows 8 and later in your domain by updating your existing AppLocker rule set. All you need is a computer running at least Windows 8. Download and install the Remote Server Administration Toolkit (RSAT) from the Microsoft Download Center. -RSAT comes with the Group Policy Management Console that allows you to edit the GPO or GPOs where your existing AppLocker policy is authored. RSAT has the necessary files required to author packaged app rules. Packaged app rules will be ignored on computers running Windows 7 and earlier but will be enforced on those computers in your domain running at least Windows Server 2012 and Windows 8. -  -  +RSAT comes with the Group Policy Management Console that allows you to edit the GPO or GPOs where your existing AppLocker policy is authored. RSAT has the necessary files required to author packaged app rules. Packaged app rules will be ignored on computers running Windows 7 and earlier but will be enforced on those computers in your domain running at least Windows Server 2012 and Windows 8. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md index 3746acc1c8..6e41e6c5e2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md @@ -1,17 +1,12 @@ --- -title: Administer AppLocker +title: Administer AppLocker description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. -ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 02/28/2019 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Administer AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -62,7 +51,7 @@ You can administer AppLocker policies by using the Group Policy Management Conso ### Administer AppLocker using Group Policy -You must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. Also, the Group Policy Management feature must be installed on the computer. +You must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. Also, the Group Policy Management feature must be installed on the computer. 1. Open the Group Policy Management Console (GPMC). 2. Locate the GPO that contains the AppLocker policy to modify, right-click the GPO, and then click **Edit**. @@ -76,4 +65,4 @@ You must have Edit Setting permission to edit a GPO. By default, members of the ## Using Windows PowerShell to administer AppLocker -For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](/powershell/module/applocker/). \ No newline at end of file +For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](/powershell/module/applocker/). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md index fee5823096..37127bd09f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md @@ -1,17 +1,12 @@ --- -title: AppLocker architecture and components +title: AppLocker architecture and components description: This topic for IT professional describes AppLocker’s basic architecture and its major components. -ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,16 +14,10 @@ ms.technology: itpro-security # AppLocker architecture and components -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). -This topic for IT professional describes AppLocker’s basic architecture and its major components. +This topic for IT professional describes AppLocker's basic architecture and its major components. AppLocker relies on the Application Identity service to provide attributes for a file and to evaluate the AppLocker policy for the file. AppLocker policies are conditional access control entries (ACEs), and policies are evaluated by using the attribute-based access control **SeAccessCheckWithSecurityAttributes** or **AuthzAccessCheck** functions. @@ -49,5 +38,3 @@ Before a script file is run, the script host (for example, for .ps1 files, the s ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md index dccdeafe16..52acbce003 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md @@ -1,17 +1,12 @@ --- -title: AppLocker functions +title: AppLocker functions description: This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. -ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker functions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This article for the IT professional lists the functions and security levels for ## Functions -Here are the SRP functions beginning with Windows Server 2003 and AppLocker functions beginning with Windows Server 2008 R2: +Here are the SRP functions beginning with Windows Server 2003 and AppLocker functions beginning with Windows Server 2008 R2: - [SaferGetPolicyInformation Function](/windows/win32/api/winsafer/nf-winsafer-safergetpolicyinformation) - [SaferCreateLevel Function](/windows/win32/api/winsafer/nf-winsafer-safercreatelevel) @@ -61,4 +50,3 @@ AppLocker and SRP use the security level IDs to specify the access requirements ## Related articles - [AppLocker technical reference](applocker-technical-reference.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 019f5a531b..c13e82db76 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -1,87 +1,63 @@ --- title: AppLocker -description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. +description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.author: vinpa -ms.prod: windows-client -ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.collection: - - highpri - - tier3 +- highpri +- tier3 ms.topic: conceptual +ms.localizationpriority: medium ms.date: 06/07/2023 -ms.technology: itpro-security --- # AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. +This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. > [!NOTE] > AppLocker is unable to control processes running under the system account on any operating system. AppLocker can help you: -- Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash. -- Assign a rule to a security group or an individual user. -- Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe). -- Use audit-only mode to deploy the policy and understand its impact before enforcing it. -- Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object. -- Simplify creating and managing AppLocker rules by using Windows PowerShell. +- Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash. +- Assign a rule to a security group or an individual user. +- Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe). +- Use audit-only mode to deploy the policy and understand its impact before enforcing it. +- Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object. +- Simplify creating and managing AppLocker rules by using Windows PowerShell. AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of Help Desk calls that result from users running unapproved apps. AppLocker addresses the following app security scenarios: -- **Application inventory** - - AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically. - -- **Protection against unwanted software** - - AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. When AppLocker rules are enforced in the production environment, any apps that aren't included in the allowed rules are blocked from running. - -- **Licensing conformance** - - AppLocker can help you create rules that preclude unlicensed software from running and restrict licensed software to authorized users. - -- **Software standardization** - - AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. - -- **Manageability improvement** - - AppLocker includes many improvements in manageability as compared to its predecessor Software Restriction Policies. Importing and exporting policies, automatic generation of rules from multiple files, audit-only mode deployment, and Windows PowerShell cmdlets are a few of the improvements over Software Restriction Policies. - +- **Application inventory**: AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically. +- **Protection against unwanted software**: AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. When AppLocker rules are enforced in the production environment, any apps that aren't included in the allowed rules are blocked from running. +- **Licensing conformance**: AppLocker can help you create rules that preclude unlicensed software from running and restrict licensed software to authorized users. +- **Software standardization**: AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. +- **Manageability improvement**: AppLocker includes many improvements in manageability as compared to its predecessor Software Restriction Policies. Importing and exporting policies, automatic generation of rules from multiple files, audit-only mode deployment, and Windows PowerShell cmdlets are a few of the improvements over Software Restriction Policies. ## When to use AppLocker -In many organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. Access control technologies, such as Active Directory Rights Management Services (AD RMS) and access control lists (ACLs), help control what users are allowed to access. +In many organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. Access control technologies, such as Active Directory Rights Management Services (AD RMS) and access control lists (ACLs), help control what users are allowed to access. -However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software. AppLocker can help mitigate these types of security breaches by restricting the files that users or groups are allowed to run. -Software publishers are beginning to create more apps that can be installed by non-administrative users. This privilege could jeopardize an organization's written security policy and circumvent traditional app control solutions that rely on the inability of users to install apps. AppLocker creates an allowed list of approved files and apps to help prevent such per-user apps from running. Because AppLocker can control DLLs, it's also useful to control who can install and run ActiveX controls. +However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software. AppLocker can help mitigate these types of security breaches by restricting the files that users or groups are allowed to run. Software publishers are beginning to create more apps that can be installed by non-administrative users. This privilege could jeopardize an organization's written security policy and circumvent traditional app control solutions that rely on the inability of users to install apps. AppLocker creates an allowed list of approved files and apps to help prevent such per-user apps from running. Because AppLocker can control DLLs, it's also useful to control who can install and run ActiveX controls. AppLocker is ideal for organizations that currently use Group Policy to manage their PCs. The following are examples of scenarios in which AppLocker can be used: -- Your organization's security policy dictates the use of only licensed software, so you need to prevent users from running unlicensed software and also restrict the use of licensed software to authorized users. -- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. -- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. -- The license to an app has been revoked or it's expired in your organization, so you need to prevent it from being used by everyone. -- A new app or a new version of an app is deployed, and you need to prevent users from running the old version. -- Specific software tools aren't allowed within the organization, or only specific users should have access to those tools. -- A single user or small group of users needs to use a specific app that is denied for all others. -- Some computers in your organization are shared by people who have different software usage needs, and you need to protect specific apps. -- In addition to other measures, you need to control the access to sensitive data through app usage. +- Your organization's security policy dictates the use of only licensed software, so you need to prevent users from running unlicensed software and also restrict the use of licensed software to authorized users. +- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. +- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. +- The license to an app has been revoked or it's expired in your organization, so you need to prevent it from being used by everyone. +- A new app or a new version of an app is deployed, and you need to prevent users from running the old version. +- Specific software tools aren't allowed within the organization, or only specific users should have access to those tools. +- A single user or small group of users needs to use a specific app that is denied for all others. +- Some computers in your organization are shared by people who have different software usage needs, and you need to protect specific apps. +- In addition to other measures, you need to control the access to sensitive data through app usage. > [!NOTE] > AppLocker is a defense-in-depth security feature and not a [security boundary](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. @@ -93,7 +69,7 @@ AppLocker can help you protect the digital assets within your organization, redu AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC). > [!NOTE] -> The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. +> GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. ### Using AppLocker on Server Core @@ -105,42 +81,38 @@ You can administer AppLocker policies by using a virtualized instance of Windows ### Security considerations -Application control policies specify which apps are allowed to run on the local computer. - -The variety of forms that malicious software can take make it difficult for users to know what is safe to run. When activated, malicious software can damage content on a hard disk drive, flood a network with requests to cause a denial-of-service (DoS) attack, send confidential information to the Internet, or compromise the security of a computer. +Application control policies specify which apps are allowed to run on the local computer. The variety of forms that malicious software can take make it difficult for users to know what is safe to run. When activated, malicious software can damage content on a hard disk drive, flood a network with requests to cause a denial-of-service (DoS) attack, send confidential information to the Internet, or compromise the security of a computer. The countermeasure is to create a sound design for your application control policies on PCs in your organization, and then thoroughly test the policies in a lab environment before you deploy them in a production environment. AppLocker can be part of your app control strategy because you can control what software is allowed to run on your computers. A flawed application control policy implementation can disable necessary applications or allow malicious or unintended software to run. Therefore, it's important that organizations dedicate sufficient resources to manage and troubleshoot the implementation of such policies. -For more information about specific security issues, see [Security considerations for AppLocker](security-considerations-for-applocker.md). +For more information about specific security issues, see [Security considerations for AppLocker](security-considerations-for-applocker.md). When you use AppLocker to create application control policies, you should be aware of the following security considerations: -When you use AppLocker to create application control policies, you should be aware of the following security considerations: - -- Who has the rights to set AppLocker policies? -- How do you validate that the policies are enforced? -- What events should you audit? +- Who has the rights to set AppLocker policies? +- How do you validate that the policies are enforced? +- What events should you audit? For reference in your security planning, the following table identifies the baseline settings for a PC with AppLocker installed: -| Setting | Default value | -| - | - | -| Accounts created | None | -| Authentication method | Not applicable | -| Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | -| Ports opened | None | +| Setting | Default value | +|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| +| Accounts created | None | +| Authentication method | Not applicable | +| Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | +| Ports opened | None | | Minimum privileges required | Administrator on the local computer; Domain Admin, or any set of rights that allow you to create, edit and distribute Group Policy Objects. | -| Protocols used | Not applicable | -| Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | -| Security Policies | None required. AppLocker creates security policies. | -| System Services required |Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | -| Storage of credentials | None | +| Protocols used | Not applicable | +| Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | +| Security Policies | None required. AppLocker creates security policies. | +| System Services required | Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | +| Storage of credentials | None | ## In this section -| Topic | Description | -| - | - | -| [Administer AppLocker](administer-applocker.md) | This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. | -| [AppLocker design guide](applocker-policies-design-guide.md) | This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | -| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | -| [AppLocker technical reference](applocker-technical-reference.md) | This overview topic for IT professionals provides links to the topics in the technical reference. | +| Article | Description | +|----------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| +| [Administer AppLocker](administer-applocker.md) | This article for IT professionals provides links to specific procedures to use when administering AppLocker policies. | +| [AppLocker design guide](applocker-policies-design-guide.md) | This article for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | +| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This article for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | +| [AppLocker technical reference](applocker-technical-reference.md) | This overview article for IT professionals provides links to the articles in the technical reference. | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md index a651d67814..2c37794578 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md @@ -1,31 +1,19 @@ --- -title: AppLocker deployment guide +title: AppLocker deployment guide description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. -ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security --- - # AppLocker deployment guide -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -63,4 +51,3 @@ This guide provides steps based on your design and planning investigation for de | [Use Software Restriction Policies and AppLocker policies](using-software-restriction-policies-and-applocker-policies.md) | This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. | | [Create Your AppLocker policies](create-your-applocker-policies.md) | This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. | | [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) | This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. | - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md index 6aff5add05..0953e691f1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md @@ -1,17 +1,12 @@ --- -title: AppLocker design guide +title: AppLocker design guide description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. -ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker design guide -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,6 +35,5 @@ To understand if AppLocker is the correct application control solution for your | [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) | This overview topic describes the process to follow when you're planning to deploy AppLocker rules. | | [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. | -  + After careful design and detailed planning, the next step is to deploy AppLocker policies. [AppLocker Deployment Guide](applocker-policies-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 46d2994927..e4b467ac07 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -1,17 +1,12 @@ --- -title: AppLocker policy use scenarios +title: AppLocker policy use scenarios description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. -ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker policy use scenarios -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -71,5 +60,3 @@ The following are examples of scenarios in which AppLocker can be used: ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md index 82be229c35..f9b3d75543 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md @@ -1,17 +1,12 @@ --- -title: AppLocker processes and interactions +title: AppLocker processes and interactions description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. -ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker processes and interactions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md index 4d62e1248b..2371faff67 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md @@ -1,17 +1,12 @@ --- -title: AppLocker settings +title: AppLocker settings description: This topic for the IT professional lists the settings used by AppLocker. -ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker settings -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md index 24739dbfcd..a4e2b5c421 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md @@ -1,17 +1,12 @@ --- -title: AppLocker technical reference +title: AppLocker technical reference description: This overview topic for IT professionals provides links to the topics in the technical reference. -ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker technical reference -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -39,9 +28,9 @@ AppLocker advances the application control features and functionality of Softwar | [Requirements to use AppLocker](requirements-to-use-applocker.md) | This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. | | [AppLocker policy use scenarios](applocker-policy-use-scenarios.md) | This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. | | [How AppLocker works](how-applocker-works-techref.md) | This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. | -| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker’s basic architecture and its major components. | +| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker's basic architecture and its major components. | | [AppLocker processes and interactions](applocker-processes-and-interactions.md) | This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. | | [AppLocker functions](applocker-functions.md) | This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. | | [Security considerations for AppLocker](security-considerations-for-applocker.md) | This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. | | [Tools to Use with AppLocker](tools-to-use-with-applocker.md) | This topic for the IT professional describes the tools available to create and administer AppLocker policies. | -| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | +| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index db47a41ae0..762f500737 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -1,17 +1,12 @@ --- -title: Configure an AppLocker policy for audit only +title: Configure an AppLocker policy for audit only description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. -ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 06/08/2018 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure an AppLocker policy for audit only -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -33,7 +22,7 @@ This topic for IT professionals describes how to set AppLocker policies to **Aud After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. -  + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). **To audit rule collections** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md index 0eaf785afa..5677e08745 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md @@ -1,17 +1,12 @@ --- -title: Configure an AppLocker policy for enforce rules +title: Configure an AppLocker policy for enforce rules description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. -ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,18 +14,12 @@ ms.technology: itpro-security # Configure an AppLocker policy for enforce rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ->**Note:**  When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. +>**Note:** When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. For info about how AppLocker policies are applied within a GPO structure, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md index 2f81ecf9ea..d7fb5a0851 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md @@ -1,17 +1,12 @@ --- -title: Add exceptions for an AppLocker rule +title: Add exceptions for an AppLocker rule description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. -ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Add exceptions for an AppLocker rule -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -45,5 +34,3 @@ You can perform this task by using the Group Policy Management Console for an Ap - For a path exception, choose the file or folder path to exclude, and then click **OK**. - For a file hash exception, edit the file hash rule, and click **Remove**. - For a packaged apps exception, click **Add** to create the exceptions based on reference app and rule scope. -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md index a9229d7b60..ad878e7040 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md @@ -1,17 +1,12 @@ --- -title: Configure the AppLocker reference device +title: Configure the AppLocker reference device description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. -ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure the AppLocker reference device -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -39,13 +28,13 @@ An AppLocker reference device that is used for the development and deployment of The reference device doesn't need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). ->**Warning:**  Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. +>**Warning:** Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. **To configure a reference device** 1. If the operating system isn't already installed, install one of the supported editions of Windows on the device. - >**Note:**  If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device + >**Note:** If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device 2. Configure the administrator account. @@ -59,5 +48,3 @@ The reference device doesn't need to be joined to a domain, but it must be able - After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this task, see [Working with AppLocker rules](working-with-applocker-rules.md). - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md index 7b55776a9f..b9261a395b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md @@ -1,17 +1,12 @@ --- -title: Configure the Application Identity service +title: Configure the Application Identity service description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. -ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561 ms.reviewer: ms.author: vinpa -ms.pagetype: security ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 07/01/2021 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure the Application Identity service -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals shows how to configure the Application Identity The Application Identity service determines and verifies the identity of an app. Stopping this service will prevent AppLocker policies from being enforced. ->**Important:**  When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. +>**Important:** When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. **To start the Application Identity service automatically using Group Policy** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md index bda3579c22..357689283c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md @@ -1,17 +1,12 @@ --- -title: Create a rule for packaged apps +title: Create a rule for packaged apps description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. -ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule for packaged apps -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -63,7 +52,7 @@ You can perform this task by using the Group Policy Management Console for an Ap |Applies to a specific **Publisher** | This setting scopes the rule to all apps published by a particular publisher. | You want to allow all your users to install apps published by the publisher of Microsoft.BingMaps. You could select Microsoft.BingMaps as a reference and choose this rule scope. | |Applies to a **Package name** | This setting scopes the rule to all packages that share the publisher name and package name as the reference file. | You want to allow your Sales group to install any version of the Microsoft.BingMaps app. You could select the Microsoft.BingMaps app as a reference and choose this rule scope. | |Applies to a **Package version** | This setting scopes the rule to a particular version of the package. | You want to be selective in what you allow. You don't want to implicitly trust all future updates of the Microsoft.BingMaps app. You can limit the scope of your rule to the version of the app currently installed on your reference computer. | - |Applying custom values to the rule | Selecting the **Use custom values** check box allows you to adjust the scope fields for your particular circumstance. | You want to allow users to install all *Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the **Use custom values** check box and edit the package name field by adding “Microsoft.Bing*” as the Package name. | + |Applying custom values to the rule | Selecting the **Use custom values** check box allows you to adjust the scope fields for your particular circumstance. | You want to allow users to install all *Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the **Use custom values** check box and edit the package name field by adding "Microsoft.Bing*" as the Package name. | 6. Select **Next**. 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. These conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md index f03d446082..592e0d0250 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a file hash condition +title: Create a rule that uses a file hash condition description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. -ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a file hash condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,7 +35,7 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins 5. On the **Conditions** page, select the **File hash** rule condition, and then click **Next**. 6. **Browse Files** to locate the targeted application file. - >**Note:**  You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. -   + >**Note:** You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. + 7. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md index c79af9cb24..019d399434 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a path condition +title: Create a rule that uses a path condition description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. -ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a path condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals shows how to create an AppLocker rule with a pat The path condition identifies an app by its location in the file system of the computer or on the network. ->**Important:**  When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. +>**Important:** When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. For info about the path condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). @@ -47,7 +36,7 @@ You can perform this task by using the Group Policy Management Console for an Ap 5. On the **Conditions** page, select the **Path** rule condition, and then click **Next**. 6. Click **Browse Files** to locate the targeted folder for the app. - >**Note:**  When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + >**Note:** When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). 7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md index 66440056c3..b7973d180c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a publisher condition +title: Create a rule that uses a publisher condition description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. -ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a publisher condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md index d9ad04fc74..a9b4962478 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md @@ -1,17 +1,12 @@ --- -title: Create AppLocker default rules +title: Create AppLocker default rules description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. -ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create AppLocker default rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md index 014f1edcd3..1811f0ba24 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -1,17 +1,12 @@ --- -title: Create a list of apps deployed to each business group +title: Create a list of apps deployed to each business group description: This topic describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker. -ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a list of apps deployed to each business group -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -81,5 +70,3 @@ For guidance, see the following topics: - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md index d632badeea..5de5930086 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Create Your AppLocker policies +title: Create Your AppLocker policies description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. -ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create Your AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,7 +33,6 @@ You can develop an application control policy plan to guide you in making succes 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 7. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - ## Step 2: Create your rules and rule collections Each rule applies to one or more apps, and it imposes a specific rule condition on them. Rules can be created individually or they can be generated by the Automatically Generate Rules Wizard. For the steps to create the rules, see [Create Your AppLocker rules](create-your-applocker-rules.md). @@ -64,7 +52,7 @@ In a test environment or with the enforcement setting set at **Audit only**, ver ## Step 6: Implement the policy -Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value—**Enforce rules** or **Audit only**. +Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value-**Enforce rules** or **Audit only**. ## Step 7: Test the effect of the policy and adjust Validate the effect of the policy by analyzing the AppLocker logs for application usage, and then modify the policy as necessary. For information on how to do these tasks, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). @@ -80,4 +68,3 @@ Follow the steps described in the following topics to continue the deployment pr ## See also - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md index 7f416d3255..5e05fb2c6e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Create Your AppLocker rules +title: Create Your AppLocker rules description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. -ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create Your AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,7 +37,7 @@ You can use a reference device to automatically create a set of default rules fo You can create rules and set the mode to **Audit only** for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you're targeting a few applications within a business group. ->**Note:**  AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). +>**Note:** AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). For information about performing this task, see: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md index 88f67e4728..e639e46f0b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md @@ -1,17 +1,12 @@ --- -title: Delete an AppLocker rule +title: Delete an AppLocker rule description: This article for IT professionals describes the steps to delete an AppLocker rule. -ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 03/10/2023 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Delete an AppLocker rule -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index 21b28d7b69..b01a4cb864 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -1,17 +1,12 @@ --- -title: Deploy AppLocker policies by using the enforce rules setting +title: Deploy AppLocker policies by using the enforce rules setting description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. -ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Deploy AppLocker policies by using the enforce rules setting -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -51,7 +40,7 @@ Rule enforcement is applied only to a collection of rules, not to individual rul You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the AppLocker policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](https://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the Microsoft Desktop Optimization Pack. ->**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. +>**Caution:** You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. For the procedure to update the GPO, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). @@ -64,5 +53,3 @@ When a policy is deployed, it's important to monitor the actual implementation o ## Other resources - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md index ae2ca63f83..bd454cbc25 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md @@ -1,17 +1,12 @@ --- -title: Deploy the AppLocker policy into production +title: Deploy the AppLocker policy into production description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. -ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Deploy the AppLocker policy into production -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md index 21bcfc2b31..75cb76fbb6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md @@ -1,17 +1,12 @@ --- -title: Determine the Group Policy structure and rule enforcement +title: Determine the Group Policy structure and rule enforcement description: This overview topic describes the process to follow when you're planning to deploy AppLocker rules. -ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine the Group Policy structure and rule enforcement -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -45,4 +34,4 @@ When you're determining how many Group Policy Objects (GPOs) to create when you - GPO naming conventions - GPO size limits ->**Note:**  There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. +>**Note:** There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index 8308562822..aae68e89c5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -1,17 +1,12 @@ --- -title: Find digitally signed apps on a reference device +title: Find digitally signed apps on a reference device description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. -ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine which apps are digitally signed on a reference device -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,5 +35,3 @@ For command parameters, syntax, and examples, see [Get-AppLockerFileInformation] ## Related topics - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) -  -  \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index 84e059c69f..bd8cd14419 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -1,17 +1,12 @@ --- -title: Determine your application control objectives +title: Determine your application control objectives description: Determine which applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. -ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine your application control objectives -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Use the following table to develop your own objectives and determine which appli |Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

AppLocker permits customization of error messages to direct users to a Web page for help.| |Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in, if the policies are created locally, or the GPMC, or the Windows PowerShell AppLocker cmdlets.| |Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| -|Enforcement mode|SRP works in the “blocklist mode” where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

SRP can also be configured in the “allowlist mode” such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|By default, AppLocker works in allowlist mode. Only those files are allowed to run for which there's a matching allow rule.| +|Enforcement mode|SRP works in the "blocklist mode" where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

SRP can also be configured in the "allowlist mode" such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|By default, AppLocker works in allowlist mode. Only those files are allowed to run for which there's a matching allow rule.| |File types that can be controlled|SRP can control the following file types:
  • Executables
  • DLLs
  • Scripts
  • Windows Installers

    SRP can't control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
  • Executables
  • DLLs
  • Scripts
  • Windows Installers
  • Packaged apps and installers

    AppLocker maintains a separate rule collection for each of the five file types.| |Designated file types|SRP supports an extensible list of file types that are considered executable. You can add extensions for files that should be considered executable.|AppLocker doesn't support this addition of extension. AppLocker currently supports the following file extensions:
  • Executables (.exe, .com)
  • DLLs (.ocx, .dll)
  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
  • Windows Installers (.msi, .mst, .msp)
  • Packaged app installers (.appx)| |Rule types|SRP supports four types of rules:
  • Hash
  • Path
  • Signature

    Internet zone|AppLocker supports three types of rules:
  • Hash
  • Path
  • Publisher| @@ -50,7 +39,7 @@ Use the following table to develop your own objectives and determine which appli |Support for different security levels|With SRP, you can specify the permissions with which an app can run. Then configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker doesn't support security levels.| |Manage Packaged apps and Packaged app installers.|Unable|.appx is a valid file type which AppLocker can manage.| |Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| -|Support for rule exceptions|SRP doesn't support rule exceptions|AppLocker rules can have exceptions that allow administrators to create rules such as “Allow everything from Windows except for Regedit.exe”.| +|Support for rule exceptions|SRP doesn't support rule exceptions|AppLocker rules can have exceptions that allow administrators to create rules such as "Allow everything from Windows except for Regedit.exe".| |Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode that allows administrators to test the effect of their policy in the real production environment without impacting the user experience. Once you're satisfied with the results, you can start enforcing the policy.| |Support for exporting and importing policies|SRP doesn't support policy import/export.|AppLocker supports the importing and exporting of policies. This support by AppLocker allows you to create AppLocker policy on a sample computer, test it out and then export that policy and import it back into the desired GPO.| |Rule enforcement|Internally, SRP rules enforcement happens in user-mode, which is less secure.|Internally, AppLocker rules for exes and dlls are enforced in kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index a06323374d..050d675248 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -1,17 +1,12 @@ --- -title: Display a custom URL message when users try to run a blocked app +title: Display a custom URL message when users try to run a blocked app description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. -ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85 ms.reviewer: ms.author: vinpa -ms.pagetype: security ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Display a custom URL message when users try to run a blocked app -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals describes the steps for displaying a customized With the help of Group Policy, AppLocker can be configured to display a message with a custom URL. You can use this URL to redirect users to a support site that contains info about why the user received the error and which apps are allowed. If you don't display a custom message when an app is blocked, the default access denied message is displayed. -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To display a custom URL message when users try to run a blocked app** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md index 46473d9aea..641ee98a64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: DLL rules in AppLocker +title: DLL rules in AppLocker description: This topic describes the file formats and available default rules for the DLL rule collection. -ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # DLL rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 23268ed540..a99df09d89 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -1,30 +1,19 @@ --- -title: Document Group Policy structure & AppLocker rule enforcement +title: Document Group Policy structure & AppLocker rule enforcement description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. -ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual -ms.pagetype: security ms.date: 09/21/2017 ms.technology: itpro-security --- # Document the Group Policy structure and AppLocker rule enforcement -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -49,13 +38,10 @@ The following table includes the sample data that was collected when you determi ||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow|| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File isn't signed; create a file hash condition|Allow|| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny|| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny|| ||||Windows files|C:\Windows|Use a default rule for the Windows path|Allow|| ## Next steps After you've determined the Group Policy structure and rule enforcement strategy for each business group's apps, the following tasks remain: - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md index 9748146d20..1e1cb3e944 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md @@ -1,17 +1,12 @@ --- -title: Document your app list +title: Document your app list description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. -ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Document your app list -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,7 +37,7 @@ The following table provides an example of how to list applications for each bus ||||Windows files|C:\Windows| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    | +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    | ||||Windows files|C:\Windows| >[!NOTE] diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index e5f75fa28f..f2803a91f2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Document your AppLocker rules +title: Document your AppLocker rules description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation. -ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Document your AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md index b336d09cf5..0ebddf77d5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Edit an AppLocker policy +title: Edit an AppLocker policy description: This topic for IT professionals describes the steps required to modify an AppLocker policy. -ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Edit an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -55,8 +44,8 @@ AppLocker provides a feature to export and import AppLocker policies as an XML f After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For information on the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). ->**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC. -  +>**Caution:** Importing a policy onto another PC will overwrite the existing policy on that PC. + ### Step 3: Use AppLocker to modify and test the rule AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. @@ -77,10 +66,10 @@ AppLocker provides ways to modify, delete, or add rules to a policy by modifying For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). ->**Caution:**  You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). -  ->**Note:**  If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. -  +>**Caution:** You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + +>**Note:** If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. + ## Editing an AppLocker policy by using the Local Security Policy snap-in The steps to edit an AppLocker policy distributed by using the Local Security Policy snap-in (secpol.msc) include the following tasks. @@ -91,8 +80,8 @@ On the PC where you maintain policies, open the AppLocker snap-in from the Local After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For information on the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). ->**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC. -  +>**Caution:** Importing a policy onto another PC will overwrite the existing policy on that PC. + ### Step 2: Identify and modify the rule to change, delete, or add AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md index 46acb129b9..5c05fb3560 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Edit AppLocker rules +title: Edit AppLocker rules description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. -ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Edit AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,4 +56,3 @@ You can perform this task by using the Group Policy Management Console for an Ap - Click the **Path** tab to configure the path on the computer in which the rule should be enforced. - Click the **Exceptions** tab to create exceptions for specific files in a folder. - When you finish updating the rule, click **OK**. - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md index e38beaacec..a97f271c3d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md @@ -1,17 +1,12 @@ --- -title: Enable the DLL rule collection +title: Enable the DLL rule collection description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. -ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Enable the DLL rule collection -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -41,4 +30,4 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties.** 2. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + >**Important:** Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md index 70a2dfe070..947a69a2ad 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Enforce AppLocker rules +title: Enforce AppLocker rules description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. -ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Enforce AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -38,7 +27,4 @@ There is no audit mode for the DLL rule collection. DLL rules affect specific ap To enforce AppLocker rules by configuring an AppLocker policy to **Enforce rules**, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). ->**Caution:**  AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). -  -  -  +>**Caution:** AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md index 1d3fbf552a..461262fab4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Executable rules in AppLocker +title: Executable rules in AppLocker description: This topic describes the file formats and available default rules for the executable rule collection. -ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Executable rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md index 7b838b91ae..bde1c865ad 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md @@ -1,17 +1,12 @@ --- -title: Export an AppLocker policy from a GPO +title: Export an AppLocker policy from a GPO description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. -ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Export an AppLocker policy from a GPO -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals describes the steps to export an AppLocker polic Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device. -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **Export the policy from the GPO** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md index 2dc105b517..93e466a216 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md @@ -1,17 +1,12 @@ --- -title: Export an AppLocker policy to an XML file +title: Export an AppLocker policy to an XML file description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. -ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Export an AppLocker policy to an XML file -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md index 40f88e9b91..e4168feaaa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md @@ -1,17 +1,12 @@ --- -title: How AppLocker works +title: How AppLocker works description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. -ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # How AppLocker works -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md index 4ce5fe6eb6..c9eee9963c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md @@ -1,17 +1,12 @@ --- -title: Import an AppLocker policy from another computer +title: Import an AppLocker policy from another computer description: This topic for IT professionals describes how to import an AppLocker policy. -ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 12/31/2017 @@ -19,12 +14,6 @@ ms.date: 12/31/2017 # Import an AppLocker policy from another computer -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2012 R2 and later - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -34,7 +23,7 @@ Before completing this procedure, you should have exported an AppLocker policy. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -> **Caution:**  Importing a policy will overwrite the existing policy on that computer. +> **Caution:** Importing a policy will overwrite the existing policy on that computer. **To import an AppLocker policy** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md index 71fb649374..aa4be6cdf0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md @@ -1,17 +1,12 @@ --- -title: Import an AppLocker policy into a GPO +title: Import an AppLocker policy into a GPO description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). -ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,21 +14,15 @@ ms.technology: itpro-security # Import an AppLocker policy into a GPO -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). ->**Important:**  Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). +>**Important:** Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To import an AppLocker policy into a GPO** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md index 551719338a..e9d52b57ce 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Maintain AppLocker policies +title: Maintain AppLocker policies description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies. -ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 12/31/2017 @@ -19,12 +14,6 @@ ms.date: 12/31/2017 # Maintain AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -50,7 +39,6 @@ Using the AppLocker configuration service provider, you can select which apps ar For more information, see the [AppLocker CSP](/windows/client-management/mdm/applocker-csp). - ## Maintaining AppLocker policies by using Group Policy For every scenario, the steps to maintain an AppLocker policy distributed by Group Policy include the following tasks. @@ -60,7 +48,7 @@ As new apps are deployed or existing apps are removed by your organization or up You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the AppLocker policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. ->**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. +>**Caution:** You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. ### Step 1: Understand the current behavior of the policy @@ -119,4 +107,4 @@ After deploying a policy, evaluate the policy's effectiveness. ## Other resources -- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). \ No newline at end of file +- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md index 1f192ee5b6..d04546c8ee 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Manage packaged apps with AppLocker +title: Manage packaged apps with AppLocker description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy. -ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Manage packaged apps with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -38,16 +27,16 @@ With packaged apps, it's possible to control the entire app by using a single Ap > [!NOTE] > AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. -Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. +Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software's publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. ### Comparing classic Windows apps and packaged apps -AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server -2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: +AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server +2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: -- **Installing the apps**   All packaged apps can be installed by a standard user, whereas many classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. -- **Changing the system state**   Classic Windows apps can be written to change the system state if they're run with administrative privileges. Most packaged apps can't change the system state because they run with limited privileges. When you design your AppLocker policies, it's important to understand whether an app that you're allowing can make system-wide changes. -- **Acquiring the apps**   Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. +- **Installing the apps** All packaged apps can be installed by a standard user, whereas many classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. +- **Changing the system state** Classic Windows apps can be written to change the system state if they're run with administrative privileges. Most packaged apps can't change the system state because they run with limited privileges. When you design your AppLocker policies, it's important to understand whether an app that you're allowing can make system-wide changes. +- **Acquiring the apps** Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. AppLocker uses different rule collections to control packaged apps and classic Windows apps. You have the choice to control one type, the other type, or both. @@ -60,7 +49,7 @@ For more info about packaged apps, see [Packaged apps and packaged app installer You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet. > [!NOTE] -> Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). +> Not all packaged apps are listed in AppLocker's application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](/powershell/module/applocker/). @@ -85,4 +74,4 @@ Just as there are differences in managing each rule collection, you need to mana 3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this update, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md). -4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this monitoring, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). \ No newline at end of file +4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this monitoring, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md index f800cda2fe..f9ff7dc54d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -1,17 +1,12 @@ --- -title: Merge AppLocker policies by using Set-ApplockerPolicy +title: Merge AppLocker policies by using Set-ApplockerPolicy description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. -ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Merge AppLocker policies by using Set-ApplockerPolicy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,4 +37,4 @@ Gets the local AppLocker policy, and then merges the policy with the existing Ap ```powershell C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge -``` \ No newline at end of file +``` diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md index 07851d0989..41657a25bd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md @@ -1,17 +1,12 @@ --- -title: Merge AppLocker policies manually +title: Merge AppLocker policies manually description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). -ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Merge AppLocker policies manually -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md index c0e644de33..32c0267869 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Monitor app usage with AppLocker +title: Monitor app usage with AppLocker description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. -ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Monitor app usage with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -75,13 +64,13 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 2. Run the following command to review how many times a file would have been blocked from running if rules were enforced: ```powershell - Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics + Get-AppLockerFileInformation -EventLog -EventType Audited -Statistics ``` 3. Run the following command to review how many times a file has been allowed to run or prevented from running: ```powershell - Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics + Get-AppLockerFileInformation -EventLog -EventType Allowed -Statistics ``` ### View the AppLocker Log in Event Viewer diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md index cca5552fbb..ef107acf59 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md @@ -1,17 +1,12 @@ --- -title: Optimize AppLocker performance +title: Optimize AppLocker performance description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. -ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Optimize AppLocker performance -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -43,4 +32,4 @@ condition. ### Using the DLL rule collection -When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. \ No newline at end of file +When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index 3c367e9dad..48e94f6635 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Packaged apps and packaged app installer rules in AppLocker +title: Packaged apps and packaged app installer rules in AppLocker description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. -ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 10/13/2017 ms.technology: itpro-security @@ -19,19 +14,13 @@ ms.technology: itpro-security # Packaged apps and packaged app installer rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker rule collection for packaged app installers and packaged apps. Universal Windows apps can be installed through the Microsoft Store or can be sideloaded using the Windows PowerShell cmdlets. Universal Windows apps can be installed by a standard user unlike some Classic Windows applications that sometimes require administrative privileges for installation. -Typically, an app consists of multiple components – the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections – exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It's therefore possible to control an entire app with a single rule. +Typically, an app consists of multiple components - the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections - exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It's therefore possible to control an entire app with a single rule. AppLocker enforces rules for Universal Windows apps separately from Classic Windows applications. A single AppLocker rule for a Universal Windows app can control both the installation and the running of an app. Because all Universal Windows apps are signed, AppLocker supports only publisher rules for Universal Windows apps. A publisher rule for a Universal Windows app is based on the following attributes of the app: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index 8384c7debf..f2e8463f25 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -1,17 +1,12 @@ --- -title: Plan for AppLocker policy management +title: Plan for AppLocker policy management description: This topic describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. -ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Plan for AppLocker policy management -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -91,7 +80,7 @@ You can edit an AppLocker policy by adding, changing, or removing rules. However **New version of a supported app** -When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you're using publisher conditions and the version isn't specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app hasn't altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. +When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you're using publisher conditions and the version isn't specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app hasn't altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version-the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version. @@ -149,7 +138,7 @@ The following table contains the added sample data that was collected when deter ||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow||Help desk| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules|Web help| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File isn't signed; create a file hash condition|Allow||Web help| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny||Web help| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny||Web help| ||||Windows files|C:\Windows|Use the default rule for the Windows path|Allow||Help desk| The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies. @@ -173,4 +162,3 @@ The following table is an example of what to consider and record. |--- |--- |--- |--- |--- | |Bank Tellers|Planned: Monthly through business office triage

    Emergency: Request through help desk|Through business office triage

    30-day notice required|General policy: Keep past versions for 12 months

    List policies for each application|Coordinated through business office

    30-day notice required| |Human Resources|Planned: Monthly through HR triage

    Emergency: Request through help desk|Through HR triage

    30-day notice required|General policy: Keep past versions for 60 months

    List policies for each application|Coordinated through HR

    30-day notice required| - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md index 5aa365b37a..06168d1e9a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Refresh an AppLocker policy +title: Refresh an AppLocker policy description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. -ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Refresh an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -36,7 +25,7 @@ To use Group Policy to distribute the AppLocker policy change, you need to retri [Edit an AppLocker policy](edit-an-applocker-policy.md) and [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). -To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To manually refresh the AppLocker policy by using Group Policy** @@ -65,6 +54,6 @@ To make the same change on another device, you can use any of the following meth - From the device that you made the change on, export the AppLocker policy, and then import the policy onto the other device. To do these tasks, use the AppLocker **Export Policy** and **Import Policy** features to copy the rules from the changed computer. - >**Caution:**  When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. -   + >**Caution:** When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. + - Merge AppLocker policies. For information on the procedures to do this merging, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) and [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index 5df2060dbd..40579e3963 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Requirements for deploying AppLocker policies +title: Requirements for deploying AppLocker policies description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. -ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Requirements for deploying AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md index 23c6363413..47b2d12aba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md @@ -1,17 +1,12 @@ --- -title: Requirements to use AppLocker +title: Requirements to use AppLocker description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. -ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Requirements to use AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -47,21 +36,21 @@ The following table shows the Windows versions on which AppLocker features are s | Version | Can be configured | Can be enforced | Available rules | Notes | | - | - | - | - | - | -| Windows 10 and Windows 11| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:

    | -| Windows Server 2019
    Windows Server 2016
    Windows Server 2012 R2
    Windows Server 2012| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | +| Windows 10 and Windows 11| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:
    | +| Windows Server 2019
    Windows Server 2016
    Windows Server 2012 R2
    Windows Server 2012| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | | Windows 8.1 Pro| Yes| No| N/A|| -| Windows 8.1 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | +| Windows 8.1 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | | Windows RT 8.1| No| No| N/A|| | Windows 8 Pro| Yes| No| N/A|| -| Windows 8 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL|| +| Windows 8 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL|| | Windows RT| No| No| N/A| | -| Windows Server 2008 R2 Standard| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Ultimate| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Enterprise| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Professional| Yes| No| Executable
    Windows Installer
    Script
    DLL| No AppLocker rules are enforced.| +| Windows Server 2008 R2 Standard| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Ultimate| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Enterprise| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Professional| Yes| No| Executable
    Windows Installer
    Script
    DLL| No AppLocker rules are enforced.| AppLocker isn't supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature isn't supported on the above operating systems. @@ -75,4 +64,4 @@ AppLocker isn't supported on versions of the Windows operating system not listed - [Optimize AppLocker performance](optimize-applocker-performance.md) - [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) - [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) -- [AppLocker Design Guide](applocker-policies-design-guide.md) \ No newline at end of file +- [AppLocker Design Guide](applocker-policies-design-guide.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md index f02e55d1b8..d6ba932c98 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md @@ -1,17 +1,12 @@ --- -title: Run the Automatically Generate Rules wizard +title: Run the Automatically Generate Rules wizard description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. -ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Run the Automatically Generate Rules wizard -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -52,4 +41,4 @@ You can perform this task by using the Group Policy Management Console for an Ap 8. Review the files that were analyzed and the rules that will be automatically created. To make changes, click **Previous** to return to the page where you can change your selections. After reviewing the rules, click **Create**. ->**Note:**  If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. +>**Note:** If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md index 77e77e2f49..bee1694c3a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Script rules in AppLocker +title: Script rules in AppLocker description: This article describes the file formats and available default rules for the script rule collection. -ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 06/15/2022 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Script rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - This article describes the file formats and available default rules for the script rule collection. AppLocker defines script rules to include only the following file formats: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md index ddcf98dc38..f32ff85c69 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md @@ -1,17 +1,12 @@ --- -title: Security considerations for AppLocker +title: Security considerations for AppLocker description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. -ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Security considerations for AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -43,9 +32,9 @@ AppLocker runs in the context of Administrator or LocalSystem, which is the high When files are being secured in a directory with a rule of the path condition type, whether using the allow or deny action on the rule, it's still necessary and good practice to restrict access to those files by setting the access control lists (ACLs) according to your security policy. -AppLocker doesn't protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there's already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it's a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. +AppLocker doesn't protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there's already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it's a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. -You can't use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this rule applies to the (POSIX) subsystem in Windows NT. If it's a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. +You can't use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this rule applies to the (POSIX) subsystem in Windows NT. If it's a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Windows PowerShell scripts. It doesn't control all interpreted code that runs within a host process, for example, Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To control interpreted code by using AppLocker, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision returned by AppLocker. Not all host processes call into AppLocker and, therefore, AppLocker can't control every kind of interpreted code, such as Microsoft Office macros. @@ -61,4 +50,4 @@ You can block the Windows Subsystem for Linux by blocking LxssManager.dll. ## Related topics -- [AppLocker technical reference](applocker-technical-reference.md) \ No newline at end of file +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md index 43ddf77312..7776bf7386 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md @@ -1,17 +1,12 @@ --- -title: Select the types of rules to create +title: Select the types of rules to create description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. -ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Select the types of rules to create -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md index 44df75bc53..0c029929bf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -1,17 +1,12 @@ --- -title: Test an AppLocker policy by using Test-AppLockerPolicy +title: Test an AppLocker policy by using Test-AppLockerPolicy description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. -ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Test an AppLocker policy by using Test-AppLockerPolicy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -41,17 +30,17 @@ Any user account can be used to complete this procedure. 1. Open a Windows PowerShell command prompt window as an administrator. 2. Use the **Get-AppLockerPolicy** cmdlet to export the effective AppLocker policy to an XML file: - `Get-AppLockerPolicy –Effective –XML > ` + `Get-AppLockerPolicy -Effective -XML > ` 2. Use the **Get-ChildItem** cmdlet to specify the directory that you want to test, specify the **Test-AppLockerPolicy** cmdlet with the XML file from the previous step to test the policy, and use the **Export-CSV** cmdlet to export the results to a file to be analyzed: - `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy -User -Filter | Export-CSV ` + `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy -XMLPolicy -User -Filter | Export-CSV ` The following shows example input for **Test-AppLockerPolicy**: ```syntax -PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml -PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv +PS C:\ Get-AppLockerPolicy -Effective -XML > C:\Effective.xml +PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' -filter *.exe -Recurse | Convert-Path | Test-AppLockerPolicy -XMLPolicy C:\Effective.xml -User contoso\zwie -Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv ``` In the example, the effective AppLocker policy is exported to the file C:\\Effective.xml. The **Get-ChildItem** cmdlet is used to recursively gather path names for the .exe files in C:\\Program Files\\Microsoft Office\\. The XMLPolicy parameter specifies that the C:\\Effective.xml file is an XML AppLocker policy file. By specifying the User parameter, you can test the rules for specific users, and the **Export-CSV** cmdlet allows the results to be exported to a comma-separated file. In the example, `-FilterDenied,DeniedByDefault` displays only those files that will be blocked for the user under the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md index 9a6dd54ca3..71815be79b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Test and update an AppLocker policy +title: Test and update an AppLocker policy description: This topic discusses the steps required to test an AppLocker policy prior to deployment. -ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Test and update an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,10 +56,8 @@ After you've identified which rules need to be edited or added to the policy, yo ## Step 6: Repeat policy testing, analysis, and policy modification -Repeat the previous steps 3–5 until all the rules perform as intended before applying enforcement. +Repeat the previous steps 3-5 until all the rules perform as intended before applying enforcement. ## Other resources - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md index 9ce6b9e70c..9fcea89142 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Tools to use with AppLocker +title: Tools to use with AppLocker description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. -ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Tools to use with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -64,4 +53,4 @@ The following tools can help you administer the application control policies cre ## Related topics -- [AppLocker technical reference](applocker-technical-reference.md) \ No newline at end of file +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md index 9b4ba84412..9b5abb0b0b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker enforcement settings +title: Understand AppLocker enforcement settings description: This topic describes the AppLocker enforcement settings for rule collections. -ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker enforcement settings -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md index 7fb08dd316..d61a4fdf98 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker policy design decisions +title: Understand AppLocker policy design decisions description: Review some common considerations while you're planning to use AppLocker to deploy application control policies within a Windows environment. -ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 10/13/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker policy design decisions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -107,7 +96,7 @@ If your organization supports multiple Windows operating systems, app control po ### Are there specific groups in your organization that need customized application control policies? -Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. +Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group's priorities before you deploy application control policies for the entire organization. | Possible answers | Design considerations | | - | - | @@ -132,7 +121,6 @@ Preventing your users from accessing known, deployed, or personal applications w | Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. | | No | Invest time in developing online support processes and documentation before deployment. | - ### Do you know what applications require restrictive policies? Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data. @@ -151,7 +139,6 @@ Implementing a successful application control policy is based on your knowledge | Strict written policy or guidelines to follow | You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules. | | No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. | - ### Does your organization already have SRP deployed? Although SRP and AppLocker have the same goal, AppLocker is a major revision of SRP. @@ -196,4 +183,3 @@ Because the effectiveness of application control policies is dependent on the ab The next step in the process is to record and analyze your answers to the preceding questions. If AppLocker is the right solution for your goals, you can set your application control policy objectives and plan your AppLocker rules. This process culminates in creating your planning document. - For info about setting your policy goals, see [Determine your application control objectives](determine-your-application-control-objectives.md). - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index e0f5c0575d..fc99a9815b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker rules and enforcement setting inheritance in Group Policy +title: Understand AppLocker rules and enforcement setting inheritance in Group Policy description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. -ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker rules and enforcement setting inheritance in Group Policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Group Policy merges AppLocker policy in two ways: 1. **Explicit deny.** An administrator created a rule to deny a file. 2. **Explicit allow.** An administrator created a rule to allow a file. 3. **Implicit deny.** This is also called the default deny because all files that are not affected by an allow rule are automatically blocked. -   + - **Enforcement settings.** The last write to the policy is applied. For example, if a higher-level GPO has the enforcement setting configured to **Enforce rules** and the closest GPO has the setting configured to **Audit only**, **Audit only** is enforced. If enforcement is not configured on the closest GPO, the setting from the closest linked GPO will be enforced. Because a computer's effective policy includes rules from each linked GPO, duplicate rules or conflicting rules could be enforced on a user's computer. Therefore, you should carefully plan your deployment to ensure that only rules that are necessary are present in a GPO. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index 82fc009a1b..ab1522f49e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -1,17 +1,12 @@ --- -title: Understand the AppLocker policy deployment process +title: Understand the AppLocker policy deployment process description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. -ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand the AppLocker policy deployment process -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,5 +33,3 @@ The following topics contain information about designing, planning, deploying, a - For info about the AppLocker policy deployment requirements and process, see [AppLocker deployment guide](applocker-policies-deployment-guide.md). - For info about AppLocker policy maintenance and monitoring, see [Administer AppLocker](administer-applocker.md). - For info about AppLocker policy architecture, components, and processing, see [AppLocker technical reference](applocker-technical-reference.md). -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index 1e8aee1c7e..cec55e8e38 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker allow and deny actions on rules +title: Understanding AppLocker allow and deny actions on rules description: This topic explains the differences between allow and deny actions on AppLocker rules. -ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker allow and deny actions on rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,7 +35,7 @@ Although you can use AppLocker to create a rule to allow all files to run and th | File hash | A user could modify the hash for a file.| | Path | A user could move the denied file to a different location and run it from there.| ->**Important:**  If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. +>**Important:** If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. ## Related topics diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md index d15cdff954..606e9924ec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker default rules +title: Understanding AppLocker default rules description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. -ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker default rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md index a54b284804..377eb5019a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule behavior +title: Understanding AppLocker rule behavior description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. -ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule behavior -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -37,8 +26,8 @@ A rule can be configured to use either an allow or deny action: - **Allow**. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny**. You can specify which files aren't allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. ->**Important:**  You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. -  +>**Important:** You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. + ## Related topics - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md index 94c277a12b..1787c045ef 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule collections +title: Understanding AppLocker rule collections description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. -ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule collections -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -40,7 +29,7 @@ An AppLocker rule collection is a set of rules that apply to one of five types: If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. ->**Important:**  Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. +>**Important:** Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). @@ -48,4 +37,3 @@ For info about how to enable the DLL rule collection, see [Enable the DLL rule c - [How AppLocker works](how-applocker-works-techref.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md index 7bdf8b04f3..b26445b191 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule condition types +title: Understanding AppLocker rule condition types description: This topic for the IT professional describes the three types of AppLocker rule conditions. -ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule condition types -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -58,15 +47,15 @@ Selecting the appropriate condition for each rule depends on the overall applica > [!NOTE] > To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, - `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. -   + `Get-AppLockerFileInformation -Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. + 2. What rule condition type does your organization prefer? If your organization is already using Software Restriction Policies (SRP) to restrict what files users can run, rules using file hash or path conditions are probably already in place. > [!NOTE] > For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md). -   + ## Related topics - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md index 4ac6b603d7..71ae842b65 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule exceptions +title: Understanding AppLocker rule exceptions description: This topic describes the result of applying AppLocker rule exceptions to rule collections. -ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule exceptions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 0582d50ebd..6e13561e2c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the file hash rule condition in AppLocker +title: Understanding the file hash rule condition in AppLocker description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it's applied. -ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the file hash rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 2e970ac2c4..5d3e6d2d29 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the path rule condition in AppLocker +title: Understanding the path rule condition in AppLocker description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it's applied. -ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the path rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,7 +33,6 @@ The asterisk (\*) wildcard character can be used within **Path** field. The aste AppLocker uses path variables for well-known directories in Windows. Path variables aren't environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. - | Windows directory or drive | AppLocker path variable | Windows environment variable | |---------------------------------------------------------|-------------------------|----------------------------------------| | Windows | %WINDIR% | %SystemRoot% | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 76fed21426..dbc7fe282d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the publisher rule condition in AppLocker +title: Understanding the publisher rule condition in AppLocker description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it's applied. -ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the publisher rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Wildcard characters can be used as values in the publisher rule fields according - **Publisher** - The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name “\*x\*”. A question mark (?) isn't a valid wildcard character in this field. + The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name "\*x\*". A question mark (?) isn't a valid wildcard character in this field. - **Product name** @@ -62,7 +51,7 @@ Wildcard characters can be used as values in the publisher rule fields according The following table describes how a publisher condition is applied. -| Option | The publisher condition allows or denies…| +| Option | The publisher condition allows or denies...| | - | - | | **All signed files** | All files that are signed by a publisher.| | **Publisher only** | All files that are signed by the named publisher.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index e63ab0e64b..eb14fbd674 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,16 +1,11 @@ --- -title: Use a reference device to create and maintain AppLocker policies +title: Use a reference device to create and maintain AppLocker policies description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. -ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.reviewer: @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use a reference device to create and maintain AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -36,7 +25,7 @@ An AppLocker reference device is a baseline device you can use to configure poli An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. ->**Important:**  The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Important:** The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. @@ -44,13 +33,13 @@ You can perform AppLocker policy testing on the reference device by using the ** With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For information on how to automatically generate rules, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). ->**Note:**  If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. +>**Note:** If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. ## Step 2: Create the default rules on the reference device AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). ->**Important:**  You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. +>**Important:** You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. ## Step 3: Modify rules and the rule collection on the reference device @@ -72,7 +61,7 @@ You should test each set of rules to ensure that they perform as intended. The * - [Test an AppLocker Policy with Test-AppLockerPolicy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791772(v=ws.10)) - [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) ->**Caution:**  If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. +>**Caution:** If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. ## Step 5: Export and import the policy into production @@ -94,4 +83,4 @@ If more refinements or updates are necessary after a policy is deployed, use the ## See also -- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) \ No newline at end of file +- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 1cfb01105a..9415499e71 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -1,17 +1,12 @@ --- -title: Use AppLocker and Software Restriction Policies in the same domain +title: Use AppLocker and Software Restriction Policies in the same domain description: This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. -ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 11/07/2022 ms.technology: itpro-security @@ -19,11 +14,6 @@ ms.technology: itpro-security # Use AppLocker and Software Restriction Policies in the same domain -**Applies to** - -- Windows 10 -- Windows Server 2016 - This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. > [!IMPORTANT] @@ -31,7 +21,7 @@ This article for IT professionals describes concepts and procedures to help you ## Using AppLocker and Software Restriction Policies in the same domain -AppLocker is supported on systems running Windows 8.1. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It's recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. +AppLocker is supported on systems running Windows 8.1. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It's recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. @@ -41,15 +31,15 @@ The following table compares the features and functions of Software Restriction |Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

    AppLocker permits customization of error messages to direct users to a Web page for help.| |Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.| |Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| -|Enforcement mode|SRP works in the “blocklist mode” where administrators can create rules for files that they don't want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

    SRP can also be configured in the “allowlist mode” so that by default all files are blocked. In "allowlist mode", administrators need to create allow rules for files that they want to run.|AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there's a matching allow rule.| +|Enforcement mode|SRP works in the "blocklist mode" where administrators can create rules for files that they don't want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

    SRP can also be configured in the "allowlist mode" so that by default all files are blocked. In "allowlist mode", administrators need to create allow rules for files that they want to run.|AppLocker by default works in the "allowlist mode" where only those files are allowed to run for which there's a matching allow rule.| |File types that can be controlled|SRP can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers

    SRP can't control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers
  • Packaged apps and installers

    AppLocker maintains a separate rule collection for each of the five file types.| |Designated file types|SRP supports an extensible list of file types that are considered executable. Administrators can add extensions for files that should be considered executable.|AppLocker currently supports the following file extensions:
  • Executables (.exe, .com)
  • Dlls (.ocx, .dll)
  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
  • Windows Installers (.msi, .mst, .msp)
  • Packaged app installers (.appx)| |Rule types|SRP supports four types of rules:
  • Hash
  • Path
  • Signature
  • Internet zone|AppLocker supports three types of rules:
  • File hash
  • Path
  • Publisher| -|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, and not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| +|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, and not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| |Support for different security levels|With SRP, you can specify the permissions with which an app can run. So, you can configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker doesn't support security levels.| |Manage Packaged apps and Packaged app installers.|Not supported|.appx is a valid file type which AppLocker can manage.| |Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| -|Support for rule exceptions|SRP doesn't support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.| +|Support for rule exceptions|SRP doesn't support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as "Allow everything from Windows except for regedit.exe".| |Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you're satisfied with the results, you can start enforcing the policy.| |Support for exporting and importing policies|SRP doesn't support policy import/export.|AppLocker supports the importing and exporting of policies. This support by AppLocker allows you to create AppLocker policy on a sample device, test it out and then export that policy and import it back into the desired GPO.| |Rule enforcement|Internally, SRP rules enforcement happens in the user-mode, which is less secure.|Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md index 6c0c369c78..155e3e6d17 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -1,17 +1,12 @@ --- -title: Use the AppLocker Windows PowerShell cmdlets +title: Use the AppLocker Windows PowerShell cmdlets description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. -ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use the AppLocker Windows PowerShell cmdlets -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -35,7 +24,7 @@ This topic for IT professionals describes how each AppLocker Windows PowerShell The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. -To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the +To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. ### Retrieve application information @@ -63,4 +52,4 @@ The [Test-AppLockerPolicy](/powershell/module/applocker/test-applockerpolicy) cm ## Other resources -- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). \ No newline at end of file +- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index c7de76bb21..2aedf66058 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Using Event Viewer with AppLocker +title: Using Event Viewer with AppLocker description: This article lists AppLocker events and describes how to use Event Viewer with AppLocker. -ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 02/02/2023 @@ -19,12 +14,6 @@ ms.date: 02/02/2023 # Using Event Viewer with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -89,4 +78,3 @@ The following table contains information about the events that you can use to de ## Related articles - [Tools to use with AppLocker](tools-to-use-with-applocker.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md index b7aec02c5b..d8b071c1c2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Use Software Restriction Policies and AppLocker policies +title: Use Software Restriction Policies and AppLocker policies description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. -ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use Software Restriction Policies and AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,23 +21,23 @@ This topic for the IT professional describes how to use Software Restriction Pol ## Understand the difference between SRP and AppLocker -You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). +You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). ## Use SRP and AppLocker in the same domain SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they're applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). ->**Important:**  As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. +>**Important:** As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. | Operating system | Tellers GPO with AppLocker policy | Tellers GPO with SRP | Tellers GPO with AppLocker policy and SRP | | - | - | - | - | -| Windows 10, Windows 8.1, Windows 8, and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| -| Windows Vista| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| -| Windows XP| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows 10, Windows 8.1, Windows 8, and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| +| Windows Vista| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows XP| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| ->**Note:**  For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Note:** For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). ## Test and validate SRPs and AppLocker policies that are deployed in the same environment diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md index 3a6fb08e52..68586393f4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md @@ -1,17 +1,12 @@ --- -title: What Is AppLocker +title: What Is AppLocker description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. -ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # What Is AppLocker? -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -83,5 +72,3 @@ The following table compares the application control functions of Software Restr ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md index 43981062e8..9a410a20af 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Windows Installer rules in AppLocker +title: Windows Installer rules in AppLocker description: This topic describes the file formats and available default rules for the Windows Installer rule collection. -ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Windows Installer rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -47,5 +36,3 @@ The purpose of this collection is to allow you to control the installation of fi ## Related topics - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md index ca6e21acbd..8e4a0a0395 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Working with AppLocker policies +title: Working with AppLocker policies description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. -ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Working with AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,5 +35,4 @@ This topic for IT professionals provides links to procedural topics about creati | [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.| | [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).| | [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This topic for IT professionals describes the steps to force an update for an AppLocker policy.| -| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| - +| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md index 2cec2568d1..8d170ef5ed 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md @@ -1,14 +1,10 @@ --- -title: Working with AppLocker rules +title: Working with AppLocker rules description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. -ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security author: vinaypamnani-msft ms.localizationpriority: medium msauthor: v-anbic @@ -19,12 +15,6 @@ ms.topic: conceptual # Working with AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,7 +57,7 @@ The AppLocker console is organized into rule collections, which are executable f | Packaged apps and packaged app installers | .appx| | DLL files | .dll
    .ocx| ->**Important:**  If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. +>**Important:** If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. @@ -93,7 +83,7 @@ This condition identifies an app based on its digital signature and extended att When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving up the slider or by using a wildcard character (\*) in the product, file name, or version number fields. ->**Note:**  To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. +>**Note:** To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: @@ -103,8 +93,7 @@ The **File version** and **Package version** control whether a user can run a sp The following table describes how a publisher condition is applied. - -| Option | The publisher condition allows or denies… | +| Option | The publisher condition allows or denies... | |---|---| | **All signed files** | All files that are signed by any publisher.| | **Publisher only**| All files that are signed by the named publisher.| @@ -132,7 +121,7 @@ The following table details these path variables. | Removable media (for example, a CD or DVD)| %REMOVABLE%| | | Removable storage device (for example, a USB flash drive)| %HOT% | | ->**Important:**  Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. +>**Important:** Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. ### File hash @@ -202,7 +191,7 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. 4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + >**Important:** Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. ## AppLocker wizards @@ -221,7 +210,7 @@ You can create rules by using two AppLocker wizards: - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule can't persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. - If an app isn't digitally signed, you can't use a publisher rule condition for that app. -- AppLocker rules can't be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. +- AppLocker rules can't be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. - The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. - When the rules for the executable rule collection are enforced and the packaged apps and packaged app installers rule collection doesn't contain any rules, no packaged apps and packaged app installers are allowed to run. In order to allow any packaged apps and packaged app installers, you must create rules for the packaged apps and packaged app installers rule collection. - When an AppLocker rule collection is set to **Audit only**, the rules aren't enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log.