MCSE 2012 Application Control Strategy AppLocker

Application Control Policy AppLocker

First, what is AppLocker?

AppLocker is a new feature in Windows Server R2 and Windows 7, and is a new system management tool for overriding software restriction policy features. The features and functionality of software restriction policies can be improved. AppLocker includes new features and extensions that you can use to create rules that allow or deny applications to run based on a unique identifier for a file, and you can also specify which users or groups can run those applications.

AppLocker exists in all versions of Windows Server R2, as well as in Windows 7 Ultimate and Windows 7 Enterprise Edition. In Windows 7 Professional, you can create AppLocker rules, but AppLocker rules cannot be enforced on computers running Windows 7 Professional.

With AppLocker, you can control the following types of applications:

• Executable files (. exe and. com)

• Scripts (. js,. PS1,. vbs,. cmd, and. bat)

• Windows Installer files (. msi and. msp)

• DLL files (. dll and. ocx)

With AppLocker, we can:

Define rules based on file attributes that derive from digital signatures, including publisher, product name, file name, and version of files. For example, you can create rules based on the publisher properties that are persisted during the update process, or you can create a rule for a specific version of a file.

Assign rules to security groups or individual users.

Create an exception for the rule. For example, you can create a rule that allows all Windows processes except Registry Editor (Regedit.exe) to run.

Use audit-only mode to deploy the policy and understand its impact before enforcing the policy.

Import and export rules. Importing and exporting affects the entire policy. For example, if you export a policy, all rules in all rule collections are exported, including mandatory settings for those collection of rules. If you import a policy, all conditions in the existing policy are overwritten.

Use Windows PowerShell cmdlets to simplify the creation and management of AppLocker rules.

Two, AppLocker and software restriction policy comparison

Function	Software Restriction policies	AppLocker
rule scope
	defined by security level: not allowed unrestricted	Allow and deny
default rule action	unrestricted	implicit deny
audit mode only	no	Yes
	no	Yes
policy import or export	no	Yes
Rule collection	Whether

This article is from the "Liu Daojun blog" blog, make sure to keep this source http://ldj027.blog.51cto.com/401017/1588037

MCSE 2012 Application Control Strategy AppLocker