This document is intended to provide information about application controls for OIT Managed Desktop supported devices. 

 

 

Information

In order to meet the EPS control 10.1.2 (Application Control), the OIT Managed Desktop Service will use Microsoft AppLocker through Group Policy when/if the need arises to block an application.  The control reads as follows:“Application Control.  Enforce an application-Whitelist (allowing access) or application-Blacklist (denying access) administratively within the OS to ensure that “known bad” applications cannot be executed and only “known good” applications can..”

See EPS Security Controls

 

 

Implementation

Since AppLocker is designed as an allow list, in order to use it as a blocklist tool, we would create a rule for the executable type in question (AppX,exe, dll, script), and "Allow all" for everyone with an exception for the target application.  Rules are defined in Group Policy under Computer Configuration\Policies\Windows Settings\Security Settings\Application Control Policies\AppLocker.  An example rule configuration designed to block Notepad is included in the screenshots below.  A new GPO would have to be created and linked by the appropriate OU Admin where needed.