# AppLocker rules in Group Policy

Compare the default and custom AppLocker rule collections recorded in Group Policy, including audit versus enforcement and the exception for packaged-app defaults. The broad publisher rules are captured examples requiring review.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

AppLocker needs to be "Configured" and set to “Enforce rules” before any apps are controlled. It is possible to configure AppLocker in Audit mode which will write the results of any policies applied to the Event Logs, without blocking apps. This is really useful when creating rules in a complex environment.

You may also notice the ability to turn on DLL rules in the Advanced tab. The source recommends leaving DLL rules off; this is part of the captured configuration rather than newly accepted policy.

![AppLocker enforcement settings](../../assets/application-control/enforcement-settings.png)

## Default Rules

The source starts with the default rules for each category except Packaged Apps. The packaged-app section below explains that exception.

### Executable Rules

- Allows any exe in the Program Files folders (C:\Program Files, C:\Program Files (x86)).
- Allows any exe in the Windows folders to run.
- Allows Local Administrators to run any exe.

![AppLocker default executable rules](../../assets/application-control/default-executable-rules.png)

### Windows Installer Rules

- Allows any MSI files to run that are digitally signed by ANY publisher. While on the face of it, this appears to allow any user to install software, in reality installation via MSI requires elevation and hence prevents standard users.
- Allows any MSI in the C:\Windows\Installer folder.
- Allows Local Administrators to install any application from MSI.

![AppLocker default installer rules](../../assets/application-control/default-installer-rules.png)

### Script Rules

- Allows any script in the Program Files folders.
- Allows any script in the Windows folders.
- Allows Local Administrators to run any script.

[Screenshot retained for review](../../review/Review-status.md#asset-50f91b6e1c795e63b931)

### Packaged App Rules

Packaged Apps are generally any app installed from the MS Store or appx packages installed via PS.

The default rule for Packaged Apps allows ANY MS Store app to be installed. This is by no means acceptable on student devices and therefore the default rule is NOT applied.

[Screenshot retained for review](../../review/Review-status.md#asset-7381a9d0e9ee172cd796)

An alternative is to block the Microsoft Store app, however this precludes enabling any self service installation of apps by students, so allowing the Store app but setting Packaged App rules is preferable.

## Custom Rules

Custom rules are created by using the Automatically Generate Rules tool in gpedit.msc. This analyzes installed applications and suggests rules based on the results.

### Executable Rules

The captured configuration includes two custom publisher rules for executables:

- Allow all software signed by Microsoft. This isn't really required, but just acts as a catch all.
- Allow software signed by AutoDesk. This allows any Autodesk apps to run. Only required as some students who have learned Autodesk in previous classes will download and install the per user version if desired. Just allows some flexibility.

### Packaged App Rules

This is by far the most complex, however using the Automatically Generated rules tool it is simple enough to come up with a short list of publishers that will cover almost all software.

It is important to note that packaged apps installed via Intune don't require an applocker rule, but they do require an EXE rule. By default packaged apps are installed to C:\Program Files\WindowsApps, which is already allowed by a default rule.

#### Hardware application publishers

- Apps signed by Realtek Semiconductor Corp
- Apps signed by Intel Corp

#### Software publishers

- signed by Microsoft - there are multiple publisher rules for MS
- Signed by Adobe Inc - there are multiple publisher rules
- Signed by Arduino LLC — included in the source for Arduino programming classes.
- Apps signed by Dell Inc (Dell Command Update).
- Allow Local Admins to run any signed packaged app.

#### Limitations of the captured publisher rules

- The captured configuration uses broad publisher rules. The author flags the Microsoft rules for further review because they also allow Microsoft Store games such as Solitaire and Minesweeper; the source reports no issue at the time, not a current acceptance of those rules.
- The hardware application publishers aren't necessarily required. The hardware and drivers will continue to work fine. These are simply for the apps that deploy from the store, such as Intel Graphics Command Centre.

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)