Windows 10: Windows 10 1809 Applocker issue - Calculator being blocked by default rule

Discus and support Windows 10 1809 Applocker issue - Calculator being blocked by default rule in Windows 10 Customization to solve the problem; <p>Since updating some machines in our enterprise to Windows 10 1809, AppLocker's default rule for Packaged App Execution is randomly blocking... Discussion in 'Windows 10 Customization' started by RickDangleton, Mar 5, 2019.

  1. Windows 10 1809 Applocker issue - Calculator being blocked by default rule


    <p>Since updating some machines in our enterprise to Windows 10 1809, AppLocker's default rule for Packaged App Execution is randomly blocking Calculator intermittently. We only have the default rule for Packaged App Execution being enforced, which allows all signed packaged apps to run, yet if I view the event log for AppLocker when the problem occurs, the event id that is logged clearly indicates AppLocker is not working properly. Instead of being filled out with details about the app, everything is blank. The RuleID is a series of zeros, the RuleName is blank, and on the general screen where the name of the app should be listed, it just says (blank) " was prevented from running" without the app name. The strangest thing about the issue is that if the user waits and tries again later, it will start working again - without even rebooting or logging off. Looking at event logs, it is probably working 99% of the time, it just randomly does this 1% of the time then returns to normal.</p><p></p><p>It does not appear to affect any other app except Calculator that I have seen, although we do not use many UWP apps. We do not have any issues with any other AppLocker rules for executables, etc., just Calculator, and only since installing 1809. I have cleared the AppLocker policy and re-applied the default rule and that had no effect on the problem. We have multiple machines exhibiting this issue so I believe this may be a bug.</p><p></p><p>Here is a sample of the event id 8022 that is generated during this issue:</p><p></p><p>General:</p><p>"&nbsp;was prevented from running."</p><p></p><p>PolicyNameLength 4&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PolicyName APPX&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleId {00000000-0000-0000-0000-000000000000}&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleNameLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleName -&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddlLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddl -&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetUser (User SID Redacted)</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetProcessId 12460&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PackageLength 0&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Package&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;FqbnLength 1&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Fqbn -&nbsp;</p><p></p><p></p><p>And here is a sample 8020 for Calculator when it was allowed to run from the very same machine.</p><p></p><p>General:</p><p>"MICROSOFT.WINDOWSCALCULATOR was allowed to run."</p><p></p><p>&nbsp;PolicyNameLength 4&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PolicyName APPX&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleId {0ff4dd23-7c87-489b-a3b8-cb2b35e5eadf}&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleNameLength 24&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleName All signed packaged apps&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddlLength 81&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;RuleSddl DWindows 10 1809 Applocker issue - Calculator being blocked by default rule :(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) &amp;&amp; ((APPID://FQBN) &gt;= ({"*\*\*",0}))))&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetUser&nbsp; (User SID Redacted)</p><p>&nbsp;</p><p>&nbsp; &nbsp;TargetProcessId 6624&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;PackageLength 27&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Package MICROSOFT.WINDOWSCALCULATOR&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;FqbnLength 129&nbsp;</p><p>&nbsp;</p><p>&nbsp; &nbsp;Fqbn CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT.WINDOWSCALCULATOR\APPX\10.1811.3241.00&nbsp;</p>

    :)
     
    RickDangleton, Mar 5, 2019
    #1
  2. chisle Win User

    Applocker not blocking -- Win10Pro, Applocker configured, AppIDsvc run


    • OS: Win10Pro
    • Applocker: configured blocking of apps and executables
    • Applocker rules: set to enforcing
    • Service: AppIDSvc is running

    I've been trying to get Edge and a couple other utilities blocked on the laptop to keep distractions to a minimum for my child who uses the computer to study.
    However, even after rules are defined, and they are set to enforcing as blocked, the apps and executables are still available to them -- even after a reboot.

    I have followed the instructions here: https://social.technet.microsoft.com...10itprogeneral
    However, there is still no blocking of the apps or the executables.
    Thank you for your consideration.
     
    chisle, Mar 5, 2019
    #2
  3. xy677 Win User
    Blocking Edge with AppLocker


    Does anyone know how to prevent Edge from running using AppLocker rules?

    I've tried various AppLocker rules to block Edge but Edge keeps running.

    If you have managed to block Edge using AppLocker, what rules did you create for this block to work?
     
    xy677, Mar 5, 2019
    #3
  4. Windows 10 1809 Applocker issue - Calculator being blocked by default rule

    AppLocker blocks everything...

    Hi!

    I am trying to use AppLocker throught GPO on a Windows 10 Enterprise 1703 with Windows Server 2012 R2. I have created the AppLocker policies, set to audit mode or enforced mode. I also added the default executable rules and then block rule for a specefic path
    location for an application in program files.

    When I start (manually or automatic on boot) the Application Identity service, everything starts being blocked. I see the blocking events in the Event Viewer for any application in any location being blocked. Even though it is in Audit only mode. If I stop
    the Application Identity service, nothing change... I need to reboot my computer (with the service set to manual only, because if it's on automatic mode, this just caused windows to crash) to be able to do something... I tried to delete this registry keys
    before starting the service, and everything works until Computer group policies applied (and this recreate these keys...):
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe There is no bad entries or something curious in there...

    So, AppLocker blocks everything, without any reasons... Can somebody help me with this problem? Is this an issue with Win10 1703? Thank you very much!

    ***Post moved by the moderator to the appropriate forum category.***
     
    Hugo Langevin, Mar 5, 2019
    #4
Thema:

Windows 10 1809 Applocker issue - Calculator being blocked by default rule

Loading...
  1. Windows 10 1809 Applocker issue - Calculator being blocked by default rule - Similar Threads - 1809 Applocker issue

  2. AppLocker blocking Windows Settings

    in Windows 10 Customization
    AppLocker blocking Windows Settings: Hi, I am using a Windows 10 Enterprise 2016 LTSB OS version 1607 OS build 14393.0 and I am trying to configure some settings for AppLocker. I have only created the basic rules, but after some time after a gpupdate I have difficulties launching the Windows Settingseven as an...
  3. AppLocker blocks .ps1 extention

    in AntiVirus, Firewalls and System Security
    AppLocker blocks .ps1 extention: Dear all. we successfully configured and implemented applocker for all domain users. But on some computers we observed some ps1 script tried to run but blocked by applocker. could you please tell me what kind of script are they?...
  4. Block a DLL with Applocker

    in Windows 10 Customization
    Block a DLL with Applocker: Hi all, On my organization we want to implement Applocker to block unauthorized DLLs. So far, I've created a very simple test, I've created an exe file that loads a function stored on a DLL. I created the program using visual studio and C#. [ATTACH] I followed the...
  5. AppLocker GPOs marked as applied but Rules are not enforced

    in AntiVirus, Firewalls and System Security
    AppLocker GPOs marked as applied but Rules are not enforced: Hi Community, We have been experiencing a problem with AppLocker GPOs in a Windows 10 Environment. The Domain functionality level is: Server 2012R2 Domain Controllers are running: Windows Server 2016 Workstations are running: Windows 10 Enterprise Build 17134 We have 2...
  6. Delete AppLocker Rule in Windows 10

    in Windows 10 Tutorials
    Delete AppLocker Rule in Windows 10: How to: Delete AppLocker Rule in Windows 10 How to Delete an AppLocker Rule in Windows 10 AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to...
  7. Export and Import AppLocker Policy for Rules in Windows 10

    in Windows 10 Tutorials
    Export and Import AppLocker Policy for Rules in Windows 10: How to: Export and Import AppLocker Policy for Rules in Windows 10 How to Export and Import AppLocker Policy for Rules in Windows 10 AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and...
  8. Blocking Edge with AppLocker

    in Browsers and Email
    Blocking Edge with AppLocker: Does anyone know how to prevent Edge from running using AppLocker rules? I've tried various AppLocker rules to block Edge but Edge keeps running. If you have managed to block Edge using AppLocker, what rules did you create for this block to work? 83673
  9. Windows 10 1703 - no "blocked" message from Applocker

    in Windows 10 Software and Apps
    Windows 10 1703 - no "blocked" message from Applocker: Trying to whip Win10 Enterprise into shape for our environment and just did my first Applocker policy (created the rules on a Win10 machine, exported and imported into my policy on our domain controllers). It worked mostly as expected. On the account of which the policy was...
  10. Applocker not blocking -- Win10Pro, Applocker configured, AppIDsvc run

    in Windows 10 Software and Apps
    Applocker not blocking -- Win10Pro, Applocker configured, AppIDsvc run: OS: Win10Pro Applocker: configured blocking of apps and executables Applocker rules: set to enforcing Service: AppIDSvc is running I've been trying to get Edge and a couple other utilities blocked on the laptop to keep distractions to a minimum for my child who uses the...

Users found this page by searching for:

  1. applocker blocking apps ruleid {00000000-0000-0000-0000-000000000000}

    ,
  2. 8022 applocker blank

    ,
  3. kernelbase.dll crash calculator.exe

    ,
  4. PolicyNameLength 3 PolicyName EXE RuleId {00000000-0000-0000-0000-000000000000},
  5. applocker windows 10 gpo not allowing calculator,
  6. applocker calculator is blocked randomly,
  7. applocker blocks calculator for some users,
  8. windows 10 enterprise 1809 application control policies appx rules not working,
  9. 1809 applocker win10pro