So let's wrap up this module with a quick demo of the App Locker policy.
So I've created a GPO.
Let me go ahead and edit it and drill into Windows Settings.
Security Settings.
Application Control Policies.
App Locker.
And you'll see here my four different kinds of executable rules.
I also have the ability to configure kind of global behavior.
So for each rule I can configure whether the rules are enforced or whether the rules are just audited.
As I had mentioned earlier.
And that's a pretty straightforward thing to do.
And I'm going to go ahead and configure executable rules to be enforced.
And then I'm going to go ahead and create some executable rules.
So the first thing I'm going to do is create default rules.
And these default rules are those rules that I mentioned that essentially create a white list or an
allow list for pretty much everything to execute by default.
So anything in program files or underneath it, anything underneath windows and then anything for members
of the built in administrators group anywhere are allowed to execute.
And now what I'm going to do is create a rule that essentially prevents Notepad from running.
So if I go in, I have some options.
I can create a new rule manually or I can use the automatically generate rules wizard.
And that will essentially scan a folder that contains executables and create rules dynamically for each
of those executables.
But we're going to go ahead and do the manual rule creation.
And I can choose to allow or deny this particular executable or this particular process for a particular
group.
In this case, I'm going to say everyone and I can choose publisher path or file hash.
In this case, I'm going to choose a specific path.
And the path that I'm going to choose is.
C Colin backslash.
Windows backslash system32 backslash notepad dot xy.
I didn't choose file hash because the file hash for a notepad is going to be different on different
versions of Windows.
So if I'm offering this rule on my server 2012 or to box and trying to apply it on a Windows seven box,
the file hash will likely not work because the file hash will have changed on notepad between the different
versions of Windows.
And that's kind of one of the downsides of file hash is you sort of have to keep up with the different
versions of each windows or of each of each version of an application that you're creating a rule for.
So now I've got my rule.
I could add an exception based on either publisher path or file hash, but I'm not going to go ahead
and do that.
And I can enter a name and I'll just say Notepad denied and create the rule.
And now I've denied everyone the ability to run.
NOTEPAD Everyone at least that processes this policy.
Now keep in mind again that this is under computer configuration.
So this policy is being applied to computers, but it is paying attention to who the users are on those
computers.
In this case, this one applies to everyone, but this one above it applies only to administrators that
are logged on to that system.
So hopefully that gives you a quick idea about how App Locker works.
By and large, I typically use this when I primarily use executable rules.
There's very few scenarios where other types of rules really make sense.
Script rules would be another area that you might consider using.
But the bottom line is that executable rules is where most of the power is in terms of whitelisting
and blacklisting.
Now, keep in mind, if I wanted to blacklist.
I'm sorry if I wanted to create a white list.
What I would do on these default rules is I would set all the action to deny.
So we would say everything in program files is denied and everything in windows is denied.
And then you would selectively allow other things that you want the user to do.
And again, you can imagine how problematic that might be.
But it is essentially the way that you can create a much more secure application whitelisting and application
control policy.