Apply AppLocker policies with Intune
Export an existing AppLocker policy to XML and review how the source separates rule collections for Intune custom profiles. The EXE, MSI, script and packaged-app OMA-URIs are listed below.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
To apply AppLocker policies it is necessary to export from gpedit.msc to an XML file.
This export will contain ALL settings, but needs to be split into 4 separate files containing the rules for each app type.
Screenshot retained for review
- Open the exported XML in VSCode, Notepad or your preferred editor.
- Copy each Rule Collection into a separate .xml file for each app type. You will end up with 4 separate .xml files containing the sets of AppLocker rules. You will notice there is a Rule Collection for Dll's. If you haven't turned on DLL rules simply ignore.
Screenshot retained for review
- In Intune, create a new Windows 10>Templates>Custom profile.
- Add an OMA-URI for Exe's
- Enter a name and Description if desired.
- Enter the OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/EXEGroup/EXE/Policy
- Select the .xml file containing the EXE rule collection. and save.
- Repeat for MSI, Scripts and Packaged Apps rule collections.
- MSI OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/MSIGroup/MSI/Policy
- Scripts OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/ScriptGroup/Script/Policy
- Packaged Apps OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/StoreAppsGroup/StoreApps/Policy
Screenshot retained for review
- Assign the policy to student devices.
- Anything that is not explicitly allowed to run, is now blocked.
For a more in depth discussion of configuring AppLocker policies in Intune see
How To Create AppLocker Policies To Secure Windows Environments Intune HTMD Blog