Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1011236" data-attributes="member: 32260">If one asks security experts about Applocker, then many of them know that Applocker can work via GPO on Windows Enterprise, Education, or Server editions. Here is the info from Microsoft (related to Windows 10 and 11):[URL unfurl=&quot;true&quot;]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker[/URL]But, as we can see from the above info, Applocker can work on Windows 10 and 11 without GPO, when managed by MDM. It is interesting because currently there are issues with Software Restriction Policies on Windows 11 ver 22H2. After some research, I found an interesting article about this possibility, written by Sandy Zeng::[URL unfurl=&quot;true&quot;]https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/[/URL]Sandy is skilled in Microsoft Endpoint Manager (ConfigMgr and Intune), Windows 10 and security.&nbsp; She applied Applocker policies for EXE files via MDM WMI Bridge. I tested this successfully also on Windows Home.After some trial and error work, I managed to create some PowerShell scripts, similar to those used in the article. These scripts can create/add/remove Applocker policies also for DLLs, scripts, MSI Installer, and packaged apps.Some interesting resources:[URL unfurl=&quot;true&quot;]https://4sysops.com/archives/enable-applocker-on-windows-10-pro-and-windows-11-pro-with-powershell/[/URL][URL unfurl=&quot;true&quot;]https://call4cloud.nl/2020/11/not-yet-another-applocker-blog/[/URL][URL unfurl=&quot;true&quot;]https://github.com/sandytsang/MSIntune/blob/master/Intune-PowerShell/AppLocker/[/URL]Edit.Warning!!!I strongly recommend making a System Restore Point before applying the Applocker rules.</blockquote>

[QUOTE="Andy Ful, post: 1011236, member: 32260"] If one asks security experts about Applocker, then many of them know that Applocker can work via GPO on Windows Enterprise, Education, or Server editions. Here is the info from Microsoft (related to Windows 10 and 11): [URL unfurl="true"]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker[/URL] But, as we can see from the above info, Applocker can work on Windows 10 and 11 without GPO, when managed by MDM. It is interesting because currently there are issues with Software Restriction Policies on Windows 11 ver 22H2. After some research, I found an interesting article about this possibility, written by Sandy Zeng: : [URL unfurl="true"]https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/[/URL] Sandy is skilled in Microsoft Endpoint Manager (ConfigMgr and Intune), Windows 10 and security. She applied Applocker policies for EXE files via MDM WMI Bridge. I tested this successfully also on Windows Home. After some trial and error work, I managed to create some PowerShell scripts, similar to those used in the article. These scripts can create/add/remove Applocker policies also for DLLs, scripts, MSI Installer, and packaged apps. Some interesting resources: [URL unfurl="true"]https://4sysops.com/archives/enable-applocker-on-windows-10-pro-and-windows-11-pro-with-powershell/[/URL] [URL unfurl="true"]https://call4cloud.nl/2020/11/not-yet-another-applocker-blog/[/URL] [URL unfurl="true"]https://github.com/sandytsang/MSIntune/blob/master/Intune-PowerShell/AppLocker/[/URL] Edit. [B][COLOR=rgb(184, 49, 47)]Warning!!! I strongly recommend making a System Restore Point before applying the Applocker rules.[/COLOR][/B] [/QUOTE]

Verification