AppLocker profile doesn't work

Question

Dear all,I have created a AppLocker profile, but not successfully. Have no idea why.OMA-URI :&nbsp;./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/Native/EXE/PolicyData Type: StringValue: &lt;RuleCollection Type="Exe" EnforcementMode="Enabled"&gt;&lt;FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"&gt;&lt;Conditions&gt;&lt;FilePathCondition Path="%PROGRAMFILES%\*" /&gt;&lt;/Conditions&gt;&lt;/FilePathRule&gt;&lt;FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"&gt;&lt;Conditions&gt;&lt;FilePathCondition Path="%WINDIR%\*" /&gt;&lt;/Conditions&gt;&lt;/FilePathRule&gt;&lt;FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"&gt;&lt;Conditions&gt;&lt;FilePathCondition Path="*" /&gt;&lt;/Conditions&gt;&lt;/FilePathRule&gt;&lt;FilePublisherRule Id="13bd601b-0f03-4ac1-bd80-ebaf375db674" Name="CHROME.EXE, in GOOGLE CHROME, from O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"&gt;&lt;Conditions&gt;&lt;FilePublisherCondition PublisherName="O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" ProductName="GOOGLE CHROME" BinaryName="CHROME.EXE"&gt;&lt;BinaryVersionRange LowSection="*" HighSection="*" /&gt;&lt;/FilePublisherCondition&gt;&lt;/Conditions&gt;&nbsp;&nbsp;Will be grateful for any help you can provide.Thanks.&nbsp;

rudy_ooms_mvp · Answer

Sk-73&nbsp;&nbsp;I would recommend starting using the "string (XML file)"&nbsp; As I have seen it happen a lot when using string&nbsp;When selecting the XML you will get an error when it is not properly formatted, besides this...I would change the last part.. (or you forgot to copy some stuff 🙂 )&nbsp;&lt;/Conditions&gt;&lt;/FilePublisherCondition&gt;&lt;/RuleCollection&gt;&nbsp;As shown below.. you could check it out yourself by editing the XML&nbsp;

rudy_ooms_mvp · Answer

What happens without that chrome part? just start with a basic export from applocker and import it into Intune to see what happens.It only occurring on 1 device or multiple?

rudy_ooms_mvp · Answer

the remediation part is only launched when the detection exits with an 1.... so start looking at the detection script i guess

sk-73 · Answer

HiRudy_Ooms_MVP&nbsp;Thank you. I just deleted the old configuration profile and create a new one but still failed.&nbsp;&nbsp;&nbsp;&lt;RuleCollection&nbsp;Type="Exe"&nbsp;EnforcementMode="Enabled"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathRule&nbsp;Id="921cc481-6e17-4653-8f75-050b80acca20"&nbsp;Name="(Default&nbsp;Rule)&nbsp;All&nbsp;files&nbsp;located&nbsp;in&nbsp;the&nbsp;Program&nbsp;Files&nbsp;folder"&nbsp;Description="Allows&nbsp;members&nbsp;of&nbsp;the&nbsp;Everyone&nbsp;group&nbsp;to&nbsp;run&nbsp;applications&nbsp;that&nbsp;are&nbsp;located&nbsp;in&nbsp;the&nbsp;Program&nbsp;Files&nbsp;folder."&nbsp;UserOrGroupSid="S-1-1-0"&nbsp;Action="Allow"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathCondition&nbsp;Path="%PROGRAMFILES%\*"&nbsp;/&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/FilePathRule&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathRule&nbsp;Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51"&nbsp;Name="(Default&nbsp;Rule)&nbsp;All&nbsp;files&nbsp;located&nbsp;in&nbsp;the&nbsp;Windows&nbsp;folder"&nbsp;Description="Allows&nbsp;members&nbsp;of&nbsp;the&nbsp;Everyone&nbsp;group&nbsp;to&nbsp;run&nbsp;applications&nbsp;that&nbsp;are&nbsp;located&nbsp;in&nbsp;the&nbsp;Windows&nbsp;folder."&nbsp;UserOrGroupSid="S-1-1-0"&nbsp;Action="Allow"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathCondition&nbsp;Path="%WINDIR%\*"&nbsp;/&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/FilePathRule&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathRule&nbsp;Id="fd686d83-a829-4351-8ff4-27c7de5755d2"&nbsp;Name="(Default&nbsp;Rule)&nbsp;All&nbsp;files"&nbsp;Description="Allows&nbsp;members&nbsp;of&nbsp;the&nbsp;local&nbsp;Administrators&nbsp;group&nbsp;to&nbsp;run&nbsp;all&nbsp;applications."&nbsp;UserOrGroupSid="S-1-5-32-544"&nbsp;Action="Allow"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePathCondition&nbsp;Path="*"&nbsp;/&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/FilePathRule&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePublisherRule&nbsp;Id="13bd601b-0f03-4ac1-bd80-ebaf375db674"&nbsp;Name="CHROME.EXE,&nbsp;in&nbsp;GOOGLE&nbsp;CHROME,&nbsp;from&nbsp;O=GOOGLE&nbsp;LLC,&nbsp;L=MOUNTAIN&nbsp;VIEW,&nbsp;S=CALIFORNIA,&nbsp;C=US"&nbsp;Description=""&nbsp;UserOrGroupSid="S-1-1-0"&nbsp;Action="Deny"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;FilePublisherCondition&nbsp;PublisherName="O=GOOGLE&nbsp;LLC,&nbsp;L=MOUNTAIN&nbsp;VIEW,&nbsp;S=CALIFORNIA,&nbsp;C=US"&nbsp;ProductName="GOOGLE&nbsp;CHROME"&nbsp;BinaryName="CHROME.EXE"&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;BinaryVersionRange&nbsp;LowSection="*"&nbsp;HighSection="*"&nbsp;/&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/FilePublisherCondition&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/Conditions&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/FilePublisherRule&gt;&nbsp;&nbsp;&lt;/RuleCollection&gt;&nbsp;I just found and follow the&nbsp;article&nbsp;create a new configuration profile (PROACTIVE REMEDIATIONS) as u mentioned.&nbsp;Waiting for the outcome.

sk-73 · Answer

Hi, Rudy_Ooms_MVP&nbsp;I have deleted the applocker profile yesterday, then I create the&nbsp;Proactive remediations. But still not successful.&nbsp;I do not see any error msg in Intune manager, at the same time, the Google Chrome is still there on my laptop... The group I assigned have two accounts, me and my colleague, is a user group...&nbsp;

Forum Discussion

AppLocker profile doesn't work

Share

Resources