Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1029275" data-attributes="member: 32260">The correction to the previous post.It is not probable that the policies discussed in the previous post are related to LowBox Token Permissive Learning Mode.I examined the AppLocker policies created on Windows 10 Pro via GPO. The segment of code containing the strings related to AppContainer is present in all policies (EXE, DLL, MSI, Script, and Appx).After removing the policies via GPO on Windows 10, AppLocker writes &quot;empty&quot; policies that do not contain that segment of code.[ATTACH=full]273435[/ATTACH]Things look slightly different on Windows 11 ver. 22H2. After removing the policies via GPO, AppLocker writes &quot;empty&quot; policies just like on Windows 10, with 2 exceptions. For EXE and DLL the nonstandard (and binary equal) policies are restored as in the previous post:[ATTACH=full]273436[/ATTACH]So, it is still kinda a mystery what is the purpose of two nonstandard policies (Exe.AppLocker and Dll.AppLocker) on Windows 11 ver. 22H2.&nbsp; They do not apply any known restrictions. So, why are they present on the fresh-installed Windows 11, even if the user did not apply any AppLocker rules?<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1029275, member: 32260"] [B]The correction to the previous post.[/B] It is not probable that the policies discussed in the previous post are related to LowBox Token Permissive Learning Mode. I examined the AppLocker policies created on Windows 10 Pro via GPO. The [B][COLOR=rgb(0, 168, 133)]segment of code[/COLOR][/B] containing the strings related to AppContainer is present in all policies (EXE, DLL, MSI, Script, and Appx). After removing the policies via GPO on [B]Windows 10[/B], AppLocker writes "empty" policies that do not contain that [B][COLOR=rgb(0, 168, 133)]segment of code.[/COLOR][/B] [ATTACH type="full" alt="1678375537607.png"]273435[/ATTACH] Things look slightly different on [B]Windows 11 ver. 22H2. [/B]After removing the policies via GPO, AppLocker writes "empty" policies just like on Windows 10, with 2 exceptions. For EXE and DLL the nonstandard (and binary equal) policies are restored as in the previous post: [ATTACH type="full" alt="1678375732284.png"]273436[/ATTACH] So, it is still kinda a mystery what is the purpose of two nonstandard policies (Exe.AppLocker and Dll.AppLocker) on Windows 11 ver. 22H2. They do not apply any known restrictions. [COLOR=rgb(184, 49, 47)][B]So, why are they present on the fresh-installed Windows 11, even if the user did not apply any AppLocker rules?[/B][/COLOR]:unsure: Post edited. [/QUOTE]

Verification