Moving Beyond Traditional Antivirus
Traditional antivirus relies on “blacklisting”—attempting to identify and block known malicious files based on constantly updated signature definitions. However, zero-day ransomware can bypass these definitions easily. AppLocker provides a massive security upgrade by enabling “whitelisting”. Instead of trying to guess what is bad, AppLocker explicitly defines exactly which executables are allowed to run (e.g., Microsoft Office, Google Chrome), and aggressively blocks every other unknown .exe, .msi, or script on the computer, effectively neutralizing unauthorized software and ransomware.
Step 1: Start the Application Identity Service
Before AppLocker can enforce any rules, the Windows client computers must be running the Application Identity service. Without it, the GPO will download, but the OS will simply ignore the rules.
Open Group Policy Management, edit your target GPO (e.g., Workstation-Security-Policy), and navigate to Computer Configuration > Policies > Windows Settings > Security Settings > System Services. Set Application Identity to Automatic.
Step 2: Create Default AppLocker Rules
Still inside the GPO, navigate to Security Settings > Application Control Policies > AppLocker > Executable Rules.
If you simply turn AppLocker on right now, it will block everything, including Windows itself, causing the computer to crash. You must create the default rules first. Right-click in the empty right-hand pane and select Create Default Rules.
AppLocker will instantly create three rules that allow the operating system to function:
1. Allow all users to run files in C:\Program Files\
2. Allow all users to run files in C:\Windows\
3. Allow the local Administrators group to run everything.
Step 3: Create a Publisher Rule (Whitelisting an App)
Because the default rules block users from running executables in their AppData or Downloads folders, standalone applications (like Zoom) will be blocked. You must create a rule to allow them.
Right-click and select Create New Rule. Choose Allow for the action. On the Conditions page, select Publisher.
Browse to the Zoom executable on your server. AppLocker will read the cryptographic digital signature embedded in the file. You can adjust the slider so that the rule allows any executable signed by “Zoom Video Communications, Inc.”, regardless of the file name or version. This is vastly superior to hash rules, which break every time the software updates.
Step 4: Enforce the Rules
Once your rules are defined, you must turn the engine on. Click on the AppLocker folder node in the left pane. In the right pane, click the “Configure rule enforcement” link.
Under Executable rules, check the “Configured” box and select Enforce rules from the dropdown. Click OK.
Step 5: Test the Block
Run gpupdate /force on a client workstation. To test the block, log in as a standard user, download a portable executable (like PuTTY or an unauthorized game) to the Desktop or Downloads folder, and double-click it.
The application will not launch. Instead, the user will receive a harsh Windows popup: “This app has been blocked by your system administrator. Contact your IT helpdesk for more info.” Your environment is now successfully locked down against unauthorized executables.