The exception to the rule - blocking Google Chrome
APPLOCKER GOOGLE CHROME .EXE
exe installer package will be blocked by the default executable rules because it cannot be added by a standard user to the trusted locations defined in AppLocker policy. For example, I don’t want users to install Google Chrome, which doesn’t require administrative rights to install and can be downloaded as an. The default rules block many scripts, executables and Windows Installer packages, but the default Windows Installer rule extends trust to a wide range of publishers. The default AppLocker rules (Image Credit: Russell Smith) Repeat the previous step for Windows Installer Rules, Script Rules, and Packaged app Rules.Note that members of the built-in Administrators group are allowed to run all files. You’ll see the rules appear to the right.
Right click Executable Rules and select Create Default Rules from the menu. In the left of the MMC console, expand Local Computer Policy, Windows Settings, Security Settings, Application Control Policies, AppLocker. Trust is defined as an executable or script located in a protected system location, such as the %windir% directory, or signed by a certificate. To ensure that AppLocker policies don’t completely disable Windows, there’s a set of default rules that enable trusted applications, scripts and installer packages to run. In the Add or Remove Snap-ins dialog, click OK. In the Services dialog, keep the default setting of Local Computer and click Finish. In the Add or Remove Snap-ins dialog, select Services in the list of available snap-ins, and click Add. In the Select Group Policy Object window, keep the default setting of Local Computer and click Finish. In the Add or Remove Snap-ins dialog, select Group Policy in the list of available snap-ins, and click Add. In the MMC console window, press CTRL+M to add a new snap-in. Enter administrative credentials if prompted. In the search results pane on the right, right click the MMC icon and select Run as administrator from the menu. Click the Start button and on the Start screen type mmc.
0 kommentar(er)
