What is AppLocker?
AppLocker is the application control feature built into Windows since Windows 7 and Windows Server 2008 R2. It lets administrators decide which programs, scripts and installers each user or group may run, and it is normally pushed to many computers at once through Group Policy or an endpoint management platform. Used as an allow list, it blocks everything not approved, which stops unknown malware, unlicensed tools and portable apps that antivirus may not flag at all.
Rule collections and conditions
AppLocker sorts rules into five collections, and each one is enforced separately:
- Executable rules:
.exeand.comfiles - Windows Installer rules:
.msi,.mspand.mstfiles - Script rules: PowerShell, batch, VBScript and JavaScript files
- Packaged app rules: Microsoft Store style apps and their installers
- DLL rules:
.dlland.ocxfiles, off by default because checking every library load costs performance
Each rule allows or denies, applies to a user or group, and identifies files by one of three conditions. A publisher condition matches the code signing certificate, optionally narrowed to a product, file name and minimum version, so it keeps working after updates. A path condition matches a folder or file location and is only as safe as that folder's write permissions. A file hash condition matches one exact file and has to be replaced whenever the file changes. Rules can carry exceptions, such as allowing everything a vendor signed except one bundled remote-access utility.
Audit mode, default rules and events
Each collection is set to either Enforce rules or Audit only. Audit mode logs what would have been blocked without blocking it, which is how a team finds the tools a department quietly depends on before enforcement stops its work. The default executable rules let Everyone run files in the Windows and Program Files folders and let administrators run anything, which keeps Windows usable while custom rules are built. Enforcement depends on the Application Identity service, so that service should be set to start automatically.
Events appear under Applications and Services Logs, Microsoft, Windows, AppLocker. In the EXE and DLL log, 8002 means a file was allowed, 8003 means it would have been blocked in audit mode, and 8004 means it was blocked. The MSI and Script log uses 8005, 8006 and 8007 for the same three outcomes. Before enforcing, an admin can test a file against the effective policy:
Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path C:\Users\Public\remote.exe -User CORP\jdoe
A decision of DeniedByDefault means no rule allows the file, so it would fall to the implicit deny.
Known weaknesses
- Path rules fail when standard users can write inside an allowed folder. Several subfolders of
C:\Windowsare writable by standard users, so the default rules are a starting point, not a finished policy. - Signed Windows programs such as
mshta.exe,regsvr32.exeandmsbuild.execan run attacker code while satisfying the rules, so a strong policy denies the ones users don't need. - A local administrator can stop the Application Identity service or change local policy. Microsoft treats AppLocker as a defense-in-depth feature rather than a security boundary.
AppLocker vs. App Control for Business
App Control for Business, formerly Windows Defender Application Control (WDAC), is Microsoft's newer application control technology. It enforces policy through kernel code integrity checks, applies to the whole device instead of to individual users, and is harder for an attacker with administrator rights to switch off. Microsoft recommends it for new deployments and keeps providing security fixes for AppLocker without adding features. AppLocker is still useful where rules must differ by user or group, such as on shared terminal servers, and the two can be combined.
AppLocker on the CompTIA Security+ exam
SY0-801 does not name AppLocker. It is a Windows tool for a control the exam does name: application allow lists and block lists, taught among the mitigating controls in objective 4.1, where Group Policy also appears as an operating system hardening tool. A scenario about Windows kiosks that must run only one approved program, or about stopping users from running unapproved executables from their Downloads folder, points to an allow list enforced with AppLocker or App Control for Business. Know the rule types: a hash rule breaks on every update, a publisher rule trusts everything that publisher signed, and a path rule fails if users can write to the path. Distractors include antivirus signatures and a HIDS, which detect rather than prevent execution, and a block list, which stops only what someone has already named.