1

We have a Windows Server 2019 operating system image with a set of local AppLocker rules defined for the server itself. We are observing that AppLocker is not enforcing any of the rules when we open applications on the server.

We have checked/attempted the following:-

  • The Application Identity Service has been set to auto startup and is running
  • Set the rule groups to use Audit mode (nothing being logged in the Windows event viewer)
  • Tweaked/reset the rules to no avail (gpupdate being run after every change)
  • The same XML policy file has been applied to a vanilla Windows Server 2019 installed in a virtual machine where it behaved as expected

Our Windows Server 2019 operating system image is deployed with a number of Group Policy settings so that it is hardened. There is the possibility that one of these could be interacting with AppLocker, but I cannot seem to find any info on which ones could be of interest.

Pirate Adam
  • 111
  • 2

1 Answers1

0

For diagnosis, open powershell and use test-applockerpolicy

Bernd Schwanenmeister
  • 422
  • 2
  • 4
  • Test-AppLockerPolicy is correctly reporting the policy decision as 'Denied' for an executable where I have set up a 'DENY' rule when I run the following: `Get-AppLockerPolicy -Local | Test-AppLockerPolicy -Path -User ` No message is shown by Windows and I am able to run the executable for that user. The Local Security Policy shows that rule enforcement is enabled. I see nothing logged in the Windows event viewer. – Pirate Adam May 13 '22 at 08:53
  • 1
    Then it's buggy behavior. Have seen that once myself. Had to turn off applocker and turn it on again and it started to work again. Another approach would be to run an inplace upgrade for windows (to the same build) and then reconfigure applocker. – Bernd Schwanenmeister May 13 '22 at 09:37