MCITP 70-640: AppLocker

AppLocker allows the administrator to control which applications are run on the computers in your domain. Check out http://itfreetraining.com for more of our always free training videos. The rules Applocker uses allow the scope of an application to be defined, like particular versions or newer version or can be narrowed down to a single application.

AppLocker
AppLocker was first added in Windows 7 and Windows Server 2008 R2 as a replacement for software restriction policies. Software restriction did not have any wizards and thus is hard to configure. AppLocker adds a wizard and is much easier to configure than Software restriction policies. Since it is aimed towards business, it only works on Windows operating systems that were targeted for business. For the client operating systems these are Windows 7 Enterprise/Ultimate and Windows 8 Enterprise. For server operating system these are Windows Server 2008 R2 Standard/Enterprise/Datacenter and Windows Server 2012 Standard/Datacenter.

AppLocker Features
Applocker can be used to monitor and control software. When AppLocker is in audit mode it will only report which software is run. If you put AppLocker in enforce mode this will allow the administrator to control which software is run. This allows a company to standardize which software is run and can be a tool used for software conformance.

AppLocker Rules
In order for AppLocker to work out which software is allow to run and which software should be blocked, AppLocker supports 3 different types of rules.
Publisher: This rule relies on the executable being digitally signed. This allows Windows to determine the Vendor, Software Title and version of the software. Publisher rules allow you to create a rule that can work with new software that was not released when the rule was created.
Hash: A hash rule puts the file through a mathematical formula to determine a value. Each file should create a different hash value, kind of like a fingerprint. This rule type can only match that executable and thus does not account for new versions of the software.
Path: This checks the location the file was run from. For example, if the executable is located in the Program Files directory.

Demonstration
AppLocker requires the Application Identity service to be running on the client. If this is not running or stopped, AppLokcer will stop working. This service can be configured in Group Policy at the following location to start automatically.
Computer Configuration\Polices\Windows Settings\Security Setting\System Service\Application Identity

AppLocker is configured in Group Policy at the following location.
Computer Configuration\Polices\Windows Settings\Security Settings\Application Control Polices\AppLocker

To configure the default properties for AppLocker, select the option "Configure rule enforcement". Rules can be applied to executable, Windows Installer files and scripts. Once you enable the ones you want you can select AppLocker to run in Audit mode or Enforce mode.

AppLocker has the option to automatically create rules. This will examine the computer and create rules based on the executables found on it. This step can be run on any computer, this includes a computer that cannot run AppLocker. You are best to run this on a computer that has the software installed on it that you use in your company so AppLocker can create the correct rules.

You can also create default rules which will be used if no other rule matches. Without any default rules, if no match is found with the existing rules the software will not be allow to run. This can prevent software in the operating system from running.

See http://YouTube.com/ITFreeTraining or http://itfreetraining.com for our always free training videos. This is only one video from the many free courses available on YouTube.

References
"MCTS 70-640 Configuring Windows Server 2008 Active Directory Second edition" pg 361 - 362
"AppLocker" http://technet.microsoft.com/en-us/li...

1. applocker windows 10 pro, applocker gpo, http://applocker.navy.mil, applocker windows 7, applocker iphone, applocker best practices, applocker rules, applocker powershell, applocker bypass, applocker policy, applocker service, applocker audit mode, applocker mac, applocker whitelist, applocker logs, applocker console, applocker not working, applocker server 2016, applocker registry, applocker executable rules, active directory users and computers, active directory windows 10, active directory domain services, active directory administrative center, active directory federation services, active directory tutorial, active directory tools, active directory ou, active directory ports, active directory recycle bin, active directory download, active directory certificate services, active directory password policy, active directory certification, active directory forest, active directory lightweight directory services, active directory powershell module, active directory ldap, active directory for dummies, active directory management tools, \u003d -570, 70-640 exam, 70-640 certification, 70-640 pdf, 70-640 study guide pdf, 70-640 exam questions pdf, 70-640 pdf ebook, mcitp systems administrator, mcitp vs mcse, mcitp-ea, mcitp enterprise administrator, mcitp server administrator, mcitp 70-640, mcitp salary, mcitp certification course, mcitp microsoft, mcitp practice test, mcitp jobs, mcitp windows 10, mcitp meaning, mcitp family support network, mcitp logo, mcitp replacement, mcitp certification cost, mcitp mcps, mcitp 2008, mcitp mcse mcts, mcts real time, mcts tracker, mctsib, mcts m card, mctssa, mcts route 15, mcts trip planner, mcts bus, mcts route 76, mcts route 27, mcts green line, mcts route 14, mcts route 30, mcts route 19, mcts gold line, mcts route 67, mcts route 23, mcts app, mcts next, mcts 80, itfreetraining youtube, itfreetraining active directory, itfreetraining adfs, itfreetraining dns, itfreetraining 70-410, itfreetraining windows server 2016, itfreetraining windows server 2012, itfreetraining vmware, itfreetraining 70-640, itfreetraining powershell, itfreetraining windows 7, itfreetraining windows 10, itfreetraining hyper v, itfreetraining group policy, itfreetraining groups, itfreetraining dfs, itfreetraining sccm, itfreetraining certificate, itfreetraining linux, itfreetraining 70-411

MCITP 70-640: AppLocker
51,888 views views	followers
222 Likes	222 Dislikes
Education	Upload TimePublished on 25 Feb 2013