How can I reliably detect new software installations on Windows endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID. They are not hybrid joined or fully Entra…
Applocker
What’s the Most Reliable Way to Detect New Software Installations on Windows Endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID, but they are not hybrid joined or fully…
What’s the safest way to move Windows 11 Enterprise devices back to Pro while keeping AppLocker working?
Our organization moved most of its Windows 11 fleet to Enterprise E3 several years ago so we could centrally manage AppLocker through Group Policy. The Microsoft 365 Enterprise…
What’s the safest way to move Windows 11 Enterprise devices back to Pro while keeping AppLocker?
Our organization upgraded most of its Windows 11 fleet to Enterprise E3 several years ago so we could centrally manage AppLocker through Group Policy. Users receive Microsoft 365…
Can Defender for Endpoint block custom process behavior like CrowdStrike IOAs?
I'm trying to determine whether Defender for Endpoint has an equivalent to CrowdStrike's Indicators of Attack that can block a specific behavior immediately, rather than only detect it…
What’s the best way to manage application allowlisting when executable names change?
A user recently needed administrator credentials just to change their default PDF reader, which got me thinking about application allowlisting. The problem is that some applications change their…
What’s the best way to manage application allowlisting when executable names change?
I recently had a user request administrator credentials just to change their default PDF reader, which made me consider using application allowlisting instead. The problem is that some…
Why is my AppLocker or Software Restriction Policy rule not blocking the program?
I created path and hash rules in Software Restriction Policies and AppLocker, but the executable still launches after running gpupdate /force and rebooting the test computer. What should…
Intune Win32 App Installs Fail Immediately on Some Devices
Several computers on our network are failing every Intune app installation almost immediately, often before anything appears to download. The affected devices can still sync successfully from the…
How can I prevent standard users from launching Server Manager on Server 2025 RDSH?
I'm piloting Windows Server 2025 RDSH as a replacement for non-persistent Windows 10 desktops. Performance has been excellent, and users mainly need Office, browsers, PuTTY, 7-Zip, and a…
How can I prevent standard users from launching Server Manager on RDSH without breaking other apps?
I'm piloting Windows Server 2025 Remote Desktop Session Host servers as a replacement for non-persistent Windows 10 VDI desktops. Performance has been excellent, and the user environment is…
Best way to configure multi-app kiosk PCs with on-premises Active Directory?
I manage several shared computers that use generic accounts and need to be locked down as much as possible. Each machine should provide access to only two or…
How to Control Browsers, VMs, and Android Emulators with AppLocker Without Over-Restricting?
I'm currently trying to secure a Windows environment using AppLocker but have hit some snags with path-based rules. I initially thought about using a firewall in learning mode…
Taskbar Issues for All Users After Enabling AppLocker on Windows Server 2022
I'm running a Windows Server 2022 setup with TSplus Terminal Services, and I've configured AppLocker with some executable rules to block EXCEL.EXE for a certain security group. However,…
Why is Copilot Being Installed on My Windows 11 Machine?
I've noticed that "Copilot" was automatically installed on some of our Windows 11 (25H2) machines that are part of a hybrid domain setup, and it appeared on March…
Seeking Agentless Solutions for Managing Software Installations on Windows
I'm looking for a way to control software installations on Windows systems by blocking them, but I want the ability to easily grant exceptions when needed. We've previously…
How Can I Effectively Block Edge and Outlook Using AppLocker?
I'm trying to comply with regulations by blocking browsing with Microsoft Edge and email access via Outlook for local admin accounts. I've been experimenting with AppLocker in Audit…
Why Are Windows Apps Being Blocked by Admin?
I'm experiencing an issue where several built-in Windows applications like Paint, Calculator, Notepad, and the Microsoft Store are showing messages that they are blocked by an administrator. I'm…
Can I Whitelist Unsigned .tmp Files in AppLocker DLL Rules?
I'm having trouble with AppLocker, particularly with how it's blocking .tmp files that follow this pattern: %OSDRIVE%PROGRAMDATA*DRIVERSTEMP*.TMP. Since these files aren't signed, I'm unable to use publisher rules.…
Can You Bypass Windows AppLocker Restrictions as Local Administrator?
I'm curious if there's a way to bypass Windows AppLocker restrictions in a domain environment, especially when the rules are enforced through Intune deployment. I'm looking for any…