Applocker policy how to#
How to leverage Aarolocker on a Intune managed device: Note: The AppLocker XML files need to be in UTF-8 encoding ween uploading to Intune In my case the files was in encoding=”utf-16″ so I had to change it to UTF-8 before uploading to Intune. Or you can just run Create-Policies.ps1 from AaronLocker toolkitĪfter the script is done running you will get “AppLockerRules-%date%-Audit.xml” and “AppLockerRules-%date%-Enforce.xml” that is perfect for using it directly with a GPO, but with Intune you need to split it up in different files with each section. You can use the AppLocker wizard as descripted in the AppLocker docs Please read the AaronLocker docs before implementation it in your production environment.įirst you need to create the AppLocker files:
Applocker policy download#
This will stop execution if a user is tricked into downloading malware, if an exploitable vulnerability in a program the user is running tries to put malware on the computer, or if a user intentionally tries to download and run unauthorized programs.ĪaronLocker is created by Aaron Margosis from Microsoft Cybersecurity Services in the doc for AaronLocker there is a guide on how to implement with GPO, so I will not cover that in this blog post.
Applocker policy windows 10#
In this blog post I will walk trough how to implement it with Microsoft Intune, it only applies to Windows 10 as Windows 7 or Windows server does not have a build-in MDM stack.ĪaronLocker’s strategy can be summed up as: if a non-admin could have put a program or script onto the computer – i.e., it is in a user-writable directory – don’t allow it to execute unless it has already been specifically allowed by an administrator. Using whitelist you are in control of what can be executed on your device, but to figure out what you need to need to whitelist in your organisation can be difficult, so AaronLocker is a easy way to getting started. In this blog post I will cover how to easy implement Applocker policies to help the end user not to run apps or scripts that are not approved from the IT department, I have seen many companies trying to implement blacklist of apps that are not allowed to run on a device, but it does not help against the threat of activating malware or ransomware.
We need to look more into help our end user to be more secure on all there devices.
I the world we are living in now, security is the most important when we are talking about information technology.
0 kommentar(er)
