Setting up AppLocker
TL;DR just my notes from a very, very basic AppLocker setup.
Background
The question was raised recently at work as to why we’re not white listing applications. It’s a good question so I dove into AppLocker, something I’d been meaning to do for awhile but just hadn’t gotten around to.
AppLocker is a free feature that’s already in Windows so there’s no additional cost. Additionally it can be centrally managed via Group Policy, managed at least to a certain degree via PowerShell, and can be exported to xml, and imported from organizations that publish best practices. In other words there’s a lot to love about it.
I tested it out in the shop.local domain that’s part of Mishky’s Cyber Range. This pre-packaged domain just has a DC and one client, automatically spins up in Hyper-V, and can be wiped and reloaded by simply running functions. This makes it perfect for testing.
Setup the GPO & create rules
One first enables AppLocker by creating a new GPO in the Group Policy Management Editor (gpmc.msc) then navigating to
Computer configuration \ Policies \ Windows Settings \ Security Settings \ Application Control Policies \ AppLocker
It’s best to start by letting AppLocker create default rules for executable files. This allows default Windows programs like Calc.exe, Notepad.exe, etc to run from inside the C:\Windows folder and legitimate programs such as Edge to run from Program Files.
Create any additional rules you need. I created one for C:\Scripts just as a test. Please note that AppLocker is not actually enabled yet, this only creates the rules.
Enable the service
The AppLocker service was not running by default. I used the same GPO to enable it under
Computer configuration \ Policies \ Windows Settings \ Security Settings \ System Services
Set ‘Application Identity’ to Automatic.
Enforce AppLocker Rules
Go back to
Computer configuration \ Policies \ Windows Settings \ Security Settings \ Application Control Policies \ AppLocker
right click on AppLocker, go into Properties, check Configured, and select ‘Enforce rules’.
Get Rich’s stories in your inbox
Join Medium for free to get updates from this writer.
Lastly right click on ‘Packaged app Rules’ and again ‘Create default rules’. If you don’t do this then users can experience odd behavior such as the Search bar in the upper right of Windows Explorer not working.
Querying AppLocker Rules
One can query what AppLocker rules are set in a certain GPO via
$ADRoot = (Get-ADDomain).DistinguishedName Get-ADObject -Filter * -SearchBase "cn=Policies,cn=System,$ADRoot" -Properties * | Select-Object DisplayName, Name
$AppLocker_GPO = (Get-ADObject -Filter * -SearchBase "cn=Policies,cn=System,$ADRoot" -Properties * | Where-Object {$_.DisplayName -like "AppLocker"}).DistinguishedName
$MainDC = (Get-ADDomain).InfrastructureMaster
(Get-AppLockerPolicy -Domain -LDAP "LDAP://$MainDC/$AppLocker_GPO").RuleCollections
Write-Host " "
Write-Host "Rule Types"
Write-Host " "
(Get-AppLockerPolicy -Domain -LDAP "LDAP://$MainDC/$AppLocker_GPO").RuleCollectionTypesOne can query what’s enforced on a given client via
(Get-AppLockerPolicy -Effective).RuleCollections
Verifying AppLocker
I RDPed into the client Shop-Client as a mere Domain User from my Kali VM and initially tried testing AppLocker by copy/pasting a *.exe from Kali. The problem was that all the *.exes I had on Kali were things like Rubeus and Mimikatz, hence Windows Defender deleted them before AppLocker could even begin to do it’s job.
After a few minutes of this misadventure I realized a much better way to test was to simply copy/paste calc.exe into C:\Temp as an Administrator and then see if a mere Domain User could run it from there.
The verdict: AppLocker works.
Summary
This is the absolute baby steps of getting started with AppLocker. I will add to this as I go, these are just my initial notes on getting it setup and functional. We will likely import rules anyway, the main challenge will be troubleshooting any issues that arise. In production we will also likely start in Audit Mode.
The great thing about having a test environment is the ability to just wing it and trial & error something before doing anything in production. The great thing about this particular test environment is the ability to quickly & easily wipe and reload it.
Bear in mind that once you create AppLocker rules in a GPO and then link that GPO to an OU that it acts like a DACL on NTFS, AD, etc. Anything that is not explicitly allowed is implicitly denied. I did not have to create a rule to Deny Domain Users run *.exe from C:\Temp. It wasn’t allowed because I did not create an Allow rule for it.
It does not escape my notice that I did not work AppLocker enumeration & bypass into Mishky’s Cyber Range. That is another project for a future howto. I’ll add it to my todo list here at test.local.
References
Setting up AppLocker via GPO: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/create-your-applocker-policies
Query & manage AppLocker with PowerShell: https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy?view=windowsserver2025-ps
STIGs RE AppLocker: https://www.stigviewer.com/stigs/microsoft_windows_10/2025-02-25/finding/V-220705
AppLocker Guidance: https://github.com/nsacyber/applocker-guidance
Importing AppLocker policies into Group Policy: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/import-an-applocker-policy-into-a-gpo
