Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Application whitelisting in Windows 7 and Windows Server 2008 R2

Microsoft's AppLocker is limited compared to third-party options, but you can't argue with the price
Page:

Microsoft's AppLocker, the application control feature included in Windows 7 and Windows Server 2008 R2, is an improvement on the Software Restriction Policies (SRP) introduced with Windows XP Professional. AppLocker allows application execution rules and exceptions to them to be defined based on file attributes such as path, publisher, product name, file name, file version, and so on. Policies can then be assigned to computers, users, security groups, and organizational units through Active Directory.

Reporting is limited to what can be pulled from log files, and creating rules for file types not defined in AppLocker can be difficult. But AppLocker's biggest drawback is that it's limited to Windows 7 Enterprise, Windows 7 Ultimate, and Windows Server 2008 R2 clients. Windows 7 Professional can be used to create policy, but cannot use AppLocker to enforce rules on itself. AppLocker cannot be used to manage earlier versions of Windows, although both Windows XP Pro's SRP and AppLocker can be similarly configured to affect an enterprise-wide policy.

AppLocker can be configured locally using the Local Computer Policy object (gpedit.msc) or using Active Directory and Group Policy Objects (GPOs). Like a lot of Microsoft's latest Active Directory-enabled technologies, administrators will need at least one domain-joined Windows Server 2008 R2 or Windows 7 computer to define and administer AppLocker. Windows 7 computers will need the Group Policy Management console feature installed as part of the Remote Server Administration Tools (RSAT) for Windows 7 (a free download). AppLocker relies on the built-in Application Identity service, which is normally set to manual startup type by default. Administrators should configure the service to start automatically.

Within the local or group policy object, AppLocker is enabled and configured under the \Computer Configuration\Windows Settings\Security Settings\Application Control Policies container.

By default, when enabled, AppLocker rules do not allow users to open or run any files that are not specifically allowed. First-time testers will benefit by allowing AppLocker to create a default set of "safe rules" using the Create Default Rules option. The default rules allow all files in Windows and Program Files to run, along with allowing members of the Administrators group to run anything.

One of the most notable improvements over SRP is the ability to run AppLocker against any participating computer using the Automatically Generate Rules option to quickly generate a baseline set of rules. In a few minutes, dozens to hundreds of rules can be created against a known clean image, saving AppLocker administrators anywhere from hours to days of work.

Page:

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Microsoft

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: application whitelisting, AppLocker, security
Latest Blog Posts
Whitepapers
  • Restore control, Reinforce security & Reduce Cost
    Uncontrolled print environments and practices present a serious risk to the profit and security of your organisation. IT is under pressure to protect sensitive information, secure devices, and improve the way they manage the entire fleet. To gain better control, your organisation needs to implement plans that meet industry regulations while also increasing productivity, lowering costs, and providing users with more flexible imaging and printing solutions. Read more.
    Learn more »
  • The Need for DLP (data leak prevention) now
    When it comes to the terabytes of confidential and proprietary data on corporate networks, companies often use kid gloves to secure the data. This begs the question, why are office supplies subject to a higher level of security than the data? Many organisations are turning to a DLP solution to help them in gaining control over their seemingly uncontrolled data stores.
    Learn more »
  • Seven SOA Practices to Unlock Business Value
    The fact is that companies are increasingly using SOA to gain competitive business advantage. Distilled down to seven essential SOA practices, the following list enables IT professionals to tightly align SOA investments with their organization’s business priorities. Using these practices can help with driving competitive advantage and adding measurable business value...and that’s a sure way for IT pros to win recognition and ongoing support within their companies.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments