You can use wildcards for folder paths and filenames.

This tells AppLocker to expect to find the executable in a specific location. Alternatively you can sign the item using a certificate. This will only work if the executable is signed by a software publisher. Another way of looking at this is to work out how to identify the said executable. You then have the option to choose a condition to meet to be able to apply this rule to an executable. You can also choose to apply this rule to a specific group of users by choosing an Active Directory security group or leave the default which is applied to the “Everyone” group. In other words, Allow is whitelisting an app and Deny is blacklisting an app. To create a rule for a executable right-click on “Executable Rules” under AppLocker and select “Create New Rule…”.Īt this point you choose whether your rule is to Allow or Deny an executable from running. This is already done in the two GPOs that currently have AppLocker policies. It is recommended to create a set of default rules for each of the collection of rules. *If your script, exe or installer require the use of DLL files then you must also create rules for the DLL files in addition to the script/exe/installer.ĪppLocker rules are only configured in the Computer Configuration of a GPO but you can apply any rule to a specific group of users or set it to apply to the “Everyone” group. To use DLL rules you have to enable it by right-clicking on “AppLocker” > Advanced tab > check “Enable the DLL rule collection”. *Note that the DLL rules node is not visible by default (as shown in the previous screenshot).

Applocker