How to Use Windows Server AppLocker to Restrict Executables

If an employee accidentally downloads a malicious .exe file disguised as a PDF invoice, traditional antivirus software relies on recognizing the file’s signature to block it. If it is a brand-new threat (a zero-day), the antivirus will let it run, instantly compromising the machine. The most effective way to secure a Windows environment is not to try and block the bad things, but to use a “default deny” posture: block absolutely everything, and only allow explicitly approved programs to run. This is called application whitelisting, and in Windows Server, it is managed through AppLocker.

Step 1: Ensure the Application Identity Service is Running

AppLocker rules are completely ignored by client computers unless the Application Identity service is running. This service is set to “Manual” by default in Windows.

1. Open the Group Policy Management Console (GPMC) on your Domain Controller.
2. Create a new GPO (e.g., “AppLocker Deployment”) and link it to an Organizational Unit (OU) containing your test computers.
3. Edit the GPO and navigate to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
4. Find Application Identity, set it to Automatic, and ensure it is started.

Step 2: Access the AppLocker Rules

Still within the same GPO, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker.

You will see several rule collections:

• Executable Rules: For .exe and .com files.
• Windows Installer Rules: For .msi and .msp files.
• Script Rules: For .ps1, .bat, .vbs, etc.
• Packaged app Rules: For Microsoft Store apps.

Step 3: Generate the Default Rules (CRITICAL)

If you turn on AppLocker without creating any rules, it immediately blocks everything—including the core Windows operating system files. If this policy applies, the computer will blue-screen on the next reboot.

You must always create the default rules first to ensure Windows can function.

1. Right-click Executable Rules and select Create Default Rules.

AppLocker will instantly generate three rules:

1. Allow everyone to run everything in C:\Windows\*
2. Allow everyone to run everything in C:\Program Files\*
3. Allow the local Administrators group to run everything everywhere.

Because standard users do not have write access to C:\Windows or C:\Program Files, they cannot drop a malicious executable into those folders. They can only save files to their Downloads or Desktop folders, where execution is now implicitly blocked.

Step 4: Create a Custom Publisher Rule

What if a user needs to run a portable application (like an internal company tool) from a network share or their Desktop? You need to explicitly allow it.

1. Right-click Executable Rules and select Create New Rule…
2. Choose Allow for the “Everyone” group.
3. On the Conditions screen, choose Publisher (this is the most secure method).
4. Browse to the .exe file of the application you want to allow.

AppLocker will read the digital certificate embedded in the executable (e.g., signed by “Adobe Inc.”). You can use the slider to determine how strict the rule is. You can allow this exact version of the file, or slide it up to allow any file digitally signed by “Adobe Inc.” regardless of the file name or location.

Step 5: Enforce the Rules (Audit Mode First)

Before you lock down a production environment, you should always run AppLocker in Audit mode for at least a week to catch any legitimate programs that might be blocked.

1. Right-click the main AppLocker folder in the GPO and select Properties.
2. Check the box next to Executable rules: Configured.
3. In the dropdown, change “Enforce rules” to Audit only.
4. Click OK.

In Audit mode, the malicious invoice will still run, but AppLocker will generate a Warning event (Event ID 8003) in the Windows Event Viewer (Applications and Services Logs > Microsoft > Windows > AppLocker). Once you have reviewed the logs and are confident your rules are perfect, change the setting to Enforce rules to lock down the network.