Windows 10: Can AppLocker restrict services?

Does anyone know if AppLocker can restrict services? After testing, I believe the answer is no, but I don't see this limitation expressed in any documentation. My testing was as follows:

X Create an AppLocker rule, dening execution of badcommand.exe to everyone

X From the console, login as user and execute badcommand.exe => execution was denied

X From the console, login as local administrator and execute badcommand.exe => execution was denied

X Using MSSQL server, use xp_cmdshell to execute badcommand.exe => execution was permitted


It seems that applocker can't restrict a service, or atleast sqlsrvr.exe is special.


Has anyone else used applocker for services? Any insights?


Thanks.


~ Tom

:)

 

How to set up AppLocker restrictions on Windows 10 Pro?

I'm installing an office PC in a small business and I was wondering how do I enable AppLocker restrictions?

It seems like I've set them up in the gpedit.msc console, then started up AppIdentity service (set it to auto-run) but no matter what I do, the restrictions are not enabled, even though this site says that AppLocker is supported on Windows 10 Pro.

Any idea how to use that AppLocker on Win10?

PS. I want to white-list which software (executables) and what types of files can be opened on that machine.

 

AppLocker FileHash

Hi,

Please check the following links

Understanding the file hash rule condition in AppLocker

https://docs.microsoft.com/en-us/windows/securi...

AppLocker processes and interactions

https://docs.microsoft.com/en-us/windows/securi...

Use AppLocker and Software Restriction Policies in the same domain

https://docs.microsoft.com/en-us/windows/securi...

Let me know if that helps.

Kind Regards,

Engr. Jamshed Muhammad

 

question about log applications and service

Hi,

Thank you for writing to Microsoft Community Forums.

The Windows Applications and Services Log enables you to monitor the Applications and Services Logs on the computer.

AppLocker helps you to control which apps and files users can run. AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. It can create rules that prelude unlicensed software from running
and restrict licensed software to authorized users. AppLocker is ideal for computers within a business group.

Refer this article on
AppLocker for more information. If you wish to block an app, you can use AppLocker. AppLocker has nothing to do with your system performance. So, I'd suggest not to disable it.

Hope it helps.

Naveen M

Microsoft Community - Moderator