Windows 10: Use AppLocker to Allow or Block Executable Files in Windows 10

How to: Use AppLocker to Allow or Block Executable Files in Windows 10

How to Use AppLocker to Allow or Block Executable Files from Running in Windows 10


packaged apps (aka: Microsoft Store apps), and packaged app installers.

AppLocker defines executable rules as any files with the .exe and .com extensions that are associated with an app. Because all of the default rules for the executable rule collection are based on folder paths, all files under those paths will be allowed. The following table lists the default rules that are available for the executable rule collection.

Any executable file not allowed by the default rules below will automatically be blocked by default unless you create a new rule to allow it for a user or group.

If you want to block an executable file allowed by the default rules below, you will need to create a new rule to block (deny) it for a user or group.

[table][tr]Purpose Name User Rule condition type [/tr] [tr][td]Allow members of the local Administrators group access to run all executable files[/td] [td](Default Rule) All files[/td] [td]BUILTIN\Administrators[/td] [td]Path: *[/td] [/tr] [tr][td]Allow all users to run executable files in the Windows folder[/td] [td](Default Rule) All files located in the Windows folder[/td] [td]Everyone[/td] [td]Path: %windir%*[/td] [/tr] [tr][td]Allow all users to run executable files in the Program Files folder[/td] [td](Default Rule) All files located in the Program Files folder[/td] [td]Everyone[/td] [td]Path: %programfiles%*[/td] [/tr] [/table]

See also:

• AppLocker (Windows 10) | Microsoft Docs
• What Is AppLocker (Windows 10) | Microsoft Docs
• ​How AppLocker works (Windows 10) | Microsoft Docs
• Requirements to use AppLocker (Windows 10) | Microsoft Docs
• Executable rules in AppLocker (Windows 10) | Microsoft Docs

This tutorial will show you how to use AppLocker to allow or block specified executable (.exe and .com) files to run for all or specific users and groups in Windows 10 Enterprise and Windows 10 Education.

*Warning You must be signed in as an administrator to use AppLocker.


EXAMPLE: "This app has been blocked by your system administrator" message when any user opens a blocked executable (.exe and .com) file






Here's How:

1. Open an elevated command prompt.

2. Copy and paste the command below into the elevated command prompt, press Enter, and close the elevated command prompt when it has finished. (see screenshot below)

*note This command is to make sure the Application Identity service is enabled, set to Automatic, and running. AppLocker cannot enforce rules if this service is not running.
*Arrow sc config "AppIDSvc" start=auto & net start "AppIDSvc"




3. Open Local Security Policy (secpol.msc).

4. Expand open Application Control Policies in the left pane of the Local Security Policy window, click/tap on AppLocker, and click/tap on the Configure rule enforcement link on the right side. (see screenshot below)



5. Check the Configured box under Executable rules, and click/tap on OK. (see screenshot below)



6. Expand open AppLocker in the left pane of the Local Security Policy window, click/tap on Packaged app Rules, right click or press and hold on Packaged app Rules, and click/tap on Create Default Rules. (see screenshots below)

*note If this step is not done, AppLocker will block all Microsoft Store apps from running.





7. Click/tap on Executable Rules, right click or press and hold on Executable Rules, and click/tap on Create Default Rules. (see screenshots below)

*note If this step is not done, AppLocker will block all executable files from running by default unless allowed by a created rule.





8. Right click or press and hold on Executable Rules, and click/tap on Create New Rule. (see screenshot below)



9. Click/tap on Next. (see screenshot below)



10. If you would like to specify a user or group to enforce this rule on, click/tap on Select. (see screenshot below)

*note The default setting is Everyone for all users and groups.




A) Click/tap on the Advanced button. (see screenshot below)



B) Click/tap on the Find Now button. (see screenshot below)



C) Select a user or group you want, and click/tap on OK. (see screenshot below)



D) Click/tap on OK. (see screenshot below)



11. Select (dot) Allow or Deny for what you want, and click/tap on Next. (see screenshot below)



12. Select (dot) Path, and click/tap on Next. (see screenshot below)



13. Do step 14 (file) or step 15 (folder/drive) below for the file or folder path you want to specify to allow or block.


14. To Specify an Executable File Path to Allow or Block
A) Click/tap on the Browse Files button. (see screenshot below)



B) Select if you want to allow or block an .exe or .com file in the drop menu at the bottom right corner. (see screenshot below)

C) Navigate to and select the .exe or .com file you want to allow or block.

D) Click/tap on Open, and go to step 16 below.





15. To Specify a Folder or Drive Path to Allow or Block All Executable Files in the Folder or Drive
A) Click/tap on the Browse Folders button. (see screenshot below)



B) Navigate to and select a folder or drive you want to allow or block all executable (.exe and .com) files in.

C) Click/tap on OK, and go to step 16 below.




16. Click/tap on Next. (see screenshots below)





17. Click/tap on Next. (see screenshots below)





18. Click/tap on Create. (see screenshots below)





19. Your new rule for "Executable Rules" will now be created. (see screenshot below)



20. Repeat steps 8 to 19 if you would like to create another new rule to allow or block another executable file for a user or group.

21. When finished, you can close the Local Security Policy window.


That's it,
Shawn


Related Tutorials

• How to Export and Import AppLocker Policy for Rules in Windows 10
• How to Clear AppLocker Policy in Windows 10
• How to Delete an AppLocker Rule in Windows 10
• How to Use AppLocker to Allow or Block Windows Installer Files from Running in Windows 10
• How to Use AppLocker to Allow or Block Script Files from Running in Windows 10
• How to Use AppLocker to Block Microsoft Store Apps from Running in Windows 10
• How to Use AppLocker to Allow or Block DLL Files from Running in Windows 10
• How to Enable or Disable Microsoft Store Apps Open Files in Default Desktop App in Windows 10
• How to Enable or Disable Run Dialog Box in Windows 7, Windows 8, and Windows 10
• How to Enable or Disable Command Prompt in Windows 7, Windows 8, and Windows 10

:)

 

How to set up AppLocker restrictions on Windows 10 Pro?

Hello @ahmd, *Smile

If you like, here are out AppLocker tutorials below that may be able to help with this for you.

• Use AppLocker to Allow or Block DLL Files from Running in Windows 10
• Use AppLocker to Allow or Block Executable Files in Windows 10
• Use AppLocker to Allow or Block Script Files in Windows 10
• Use AppLocker to Allow or Block Windows Installer Files in Windows 10
• Use AppLocker to Block Microsoft Store Apps in Windows 10
• Export and Import AppLocker Policy for Rules in Windows 10
• Clear AppLocker Policy in Windows 10
• Delete AppLocker Rule in Windows 10

 

How to set up AppLocker restrictions on Windows 10 Pro?

Dude, thanks for the info and sorry for my late reply. I've been bashing my head against it but I still can't make it work. I did everything like it says there but it still didn't do anything. It doesn't block anything. The only difference that I see in your tutorial is this line:

Like I said I have Pro.

 

Block an executable file with AppLocker

Hi everyone,

Does anyone here know how I can block (grey out) the "Reset this PC" on Windows 10 via AppLocker?

 

Applocker not blocking -- Win10Pro, Applocker configured, AppIDsvc run

• OS: Win10Pro
• Applocker: configured blocking of apps and executables
• Applocker rules: set to enforcing
• Service: AppIDSvc is running

I've been trying to get Edge and a couple other utilities blocked on the laptop to keep distractions to a minimum for my child who uses the computer to study.
However, even after rules are defined, and they are set to enforcing as blocked, the apps and executables are still available to them -- even after a reboot.

I have followed the instructions here: https://social.technet.microsoft.com...10itprogeneral
However, there is still no blocking of the apps or the executables.
Thank you for your consideration.

 

AppLocker blocks everything...

Hi!

I am trying to use AppLocker throught GPO on a Windows 10 Enterprise 1703 with Windows Server 2012 R2. I have created the AppLocker policies, set to audit mode or enforced mode. I also added the default executable rules and then block rule for a specefic path
location for an application in program files.

When I start (manually or automatic on boot) the Application Identity service, everything starts being blocked. I see the blocking events in the Event Viewer for any application in any location being blocked. Even though it is in Audit only mode. If I stop
the Application Identity service, nothing change... I need to reboot my computer (with the service set to manual only, because if it's on automatic mode, this just caused windows to crash) to be able to do something... I tried to delete this registry keys
before starting the service, and everything works until Computer group policies applied (and this recreate these keys...):
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe There is no bad entries or something curious in there...

So, AppLocker blocks everything, without any reasons... Can somebody help me with this problem? Is this an issue with Win10 1703? Thank you very much!

***Post moved by the moderator to the appropriate forum category.***