AppLocker
Some IT departments choose to control which applications users can run. Sometimes, administrators simply block specific applications that are known to be problematic. However, client security benefits more when administrators block all applications that IT has not approved.
The benefits of restricting users from running applications that are not approved can be immense. First, the risk of malware is significantly reduced, because Windows would prevent users from running the malware application because it had not been approved by IT. Second, compatibility problems are reduced, because users can only run approved versions of applications. Finally, user productivity is increased by eliminating the possibility that users could run games or other applications that might take time away from their work.
Restricting users from running applications does have significant costs, however, and for many organizations, those costs outweigh the benefits. IT has to test each application and create a rule that allows users to run it. Inevitably, users will be prevented from running legitimate applications, which can reduce their productivity while they wait for IT to approve a new application. Sometimes, users will choose to work around IT by running applications on non-IT computers. Each time an application is updated, IT needs to again test and approve the application.
Windows 7 includes AppLocker, which is an update to Software Restriction Policies, a feature in earlier versions of Windows. With Software Restriction Policies, IT professionals could create rules such as "Trust all content signed by Microsoft," "Trust this single executable file," or "Trust the file at this path." With AppLocker, IT professionals can create more refined rules based on an application's metadata, such as "Trust Microsoft Office if it is signed and the version is greater than 12.0.0.0." Additionally, AppLocker rules can be assigned on a per-group and per-user basis.
Table lists the differences between Software Restriction Policies and AppLocker
Software Restriction Policies Compared to AppLocker
Feature | Software Restriction Policies | Applocker |
Conditions | Hash, path, certificate, registry path, and Internet zone | Hash, path, and publisher |
Rule scope | All users | All users, or specific users and groups |
Audit-only mode | No | Yes |
Automatically generate rules | No | Yes |
Policy import and export No | No | Yes |
Windows PowerShell support | No | Yes |
Custom error messages | No | Yes |
AppLocker is available only in Windows 7 Enterprise and Windows 7 Ultimate Editions. You can use Windows 7 Professional Edition to create AppLocker rules, but the rules will not be enforced on the computer running Windows 7 Professional. You must configure the Application Identity service to start for Windows 7 to apply AppLocker rules; by default, it is configured to start manually.
The sections that follow provide more detailed information about how to configure, test, and manage AppLocker.
In this tutorial:
- Windows 7 Client Protection
- Understanding the Risk of Malware
- User Account Control in Windows 7
- UAC for Standard Users
- UAC for Administrators
- UAC User Interface
- Secure Desktop
- How Windows Determines Whether an Application Needs Administrative Privileges
- How to Control UAC Using Application Properties
- How UAC Examines the Application Manifest
- UAC Heuristics
- UAC Virtualization
- UAC and Startup Programs
- Compatibility Problems with UAC
- How to Configure UAC
- Group Policy Settings
- Control Panel
- Msconfig.exe
- How to Configure Auditing for Privilege Elevation
- Other UAC Event Logs
- Best Practices for Using UAC
- AppLocker
- AppLocker Rule Types
- Auditing AppLocker Rules
- DLL Rules
- Custom Error Messages
- Using AppLocker with Windows PowerShell
- Using Windows 7 Defender
- Understanding Windows Defender
- Automatic Scanning
- Real-Time Protection
- Windows Defender Alert Levels
- Understanding Microsoft SpyNet
- Configuring Windows Defender Group Policy
- Configuring Windows Defender on a Single Computer
- How to Determine Whether a Computer Is Infected with Spyware
- Best Practices for Using Windows Defender
- How to Troubleshoot Problems with Unwanted Software
- Network Access Protection
- Forefront