Windows 10: Windows 10 1809 Applocker issue - Calculator being blocked by default rule

<p>Since updating some machines in our enterprise to Windows 10 1809, AppLocker's default rule for Packaged App Execution is randomly blocking Calculator intermittently. We only have the default rule for Packaged App Execution being enforced, which allows all signed packaged apps to run, yet if I view the event log for AppLocker when the problem occurs, the event id that is logged clearly indicates AppLocker is not working properly. Instead of being filled out with details about the app, everything is blank. The RuleID is a series of zeros, the RuleName is blank, and on the general screen where the name of the app should be listed, it just says (blank) " was prevented from running" without the app name. The strangest thing about the issue is that if the user waits and tries again later, it will start working again - without even rebooting or logging off. Looking at event logs, it is probably working 99% of the time, it just randomly does this 1% of the time then returns to normal.</p><p></p><p>It does not appear to affect any other app except Calculator that I have seen, although we do not use many UWP apps. We do not have any issues with any other AppLocker rules for executables, etc., just Calculator, and only since installing 1809. I have cleared the AppLocker policy and re-applied the default rule and that had no effect on the problem. We have multiple machines exhibiting this issue so I believe this may be a bug.</p><p></p><p>Here is a sample of the event id 8022 that is generated during this issue:</p><p></p><p>General:</p><p>"&nbsp;was prevented from running."</p><p></p><p>PolicyNameLength 4&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PolicyName APPX&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleId {00000000-0000-0000-0000-000000000000}&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleNameLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleName -&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddlLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddl -&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetUser (User SID Redacted)</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetProcessId 12460&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PackageLength 0&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Package&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;FqbnLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Fqbn -&nbsp;</p><p></p><p></p><p>And here is a sample 8020 for Calculator when it was allowed to run from the very same machine.</p><p></p><p>General:</p><p>"MICROSOFT.WINDOWSCALCULATOR was allowed to run."</p><p></p><p>&nbsp;PolicyNameLength 4&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PolicyName APPX&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleId {0ff4dd23-7c87-489b-a3b8-cb2b35e5eadf}&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleNameLength 24&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleName All signed packaged apps&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddlLength 81&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddl DXA;;FX;;;S-1-1-0;((Exists APPID://FQBN) &amp;&amp; ((APPID://FQBN) &gt;= ({"*\*\*",0}))))&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetUser&nbsp; (User SID Redacted)</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetProcessId 6624&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PackageLength 27&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Package MICROSOFT.WINDOWSCALCULATOR&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;FqbnLength 129&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Fqbn CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWSCALCULATOR\APPX\10.1811.3241.00&nbsp;</p>

:)

 

Applocker not blocking -- Win10Pro, Applocker configured, AppIDsvc run

• OS: Win10Pro
• Applocker: configured blocking of apps and executables
• Applocker rules: set to enforcing
• Service: AppIDSvc is running

I've been trying to get Edge and a couple other utilities blocked on the laptop to keep distractions to a minimum for my child who uses the computer to study.
However, even after rules are defined, and they are set to enforcing as blocked, the apps and executables are still available to them -- even after a reboot.

I have followed the instructions here: https://social.technet.microsoft.com...10itprogeneral
However, there is still no blocking of the apps or the executables.
Thank you for your consideration.

 

Blocking Edge with AppLocker


Does anyone know how to prevent Edge from running using AppLocker rules?

I've tried various AppLocker rules to block Edge but Edge keeps running.

If you have managed to block Edge using AppLocker, what rules did you create for this block to work?

 

AppLocker blocks everything...

Hi!

I am trying to use AppLocker throught GPO on a Windows 10 Enterprise 1703 with Windows Server 2012 R2. I have created the AppLocker policies, set to audit mode or enforced mode. I also added the default executable rules and then block rule for a specefic path
location for an application in program files.

When I start (manually or automatic on boot) the Application Identity service, everything starts being blocked. I see the blocking events in the Event Viewer for any application in any location being blocked. Even though it is in Audit only mode. If I stop
the Application Identity service, nothing change... I need to reboot my computer (with the service set to manual only, because if it's on automatic mode, this just caused windows to crash) to be able to do something... I tried to delete this registry keys
before starting the service, and everything works until Computer group policies applied (and this recreate these keys...):
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe There is no bad entries or something curious in there...

So, AppLocker blocks everything, without any reasons... Can somebody help me with this problem? Is this an issue with Win10 1703? Thank you very much!

***Post moved by the moderator to the appropriate forum category.***