I created path and hash rules in Software Restriction Policies and AppLocker, but the executable still launches after running gpupdate /force and rebooting the test computer. What should I check to confirm the policy is actually applied and enforced?
3 Answers
Start by running gpresult on the test machine and confirm that the intended Group Policy Object is actually applied. Also check the effective AppLocker policy with Get-AppLockerPolicy, since creating a rule in a policy does not prove the client received it. Make sure AppLocker is set to Enforced rather than Audit mode.
The issue turned out to be policy scope, not the rule itself. The test computer was in a separate testing group, and its policy was only copied from the original rather than updated along with it. Once the correct policy was edited or linked for that computer, the changes applied and the executable was blocked.
The Application Identity service must be running for AppLocker enforcement to work. If this is a new deployment, configure that service to start automatically and verify its status on the client. Also confirm that the Windows edition and management method support the AppLocker configuration you are using.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures