Let's see how work with application control rules looks and practice will switch to a test Windows 7
operating system like for all administrative operations will be using them see a Microsoft management
console
will Nilus snap in for group policies.
Will use now local group policies but the policies usually are created at a higher level.
For example for all computers of a specified type or for all computers that belong to a given group
of users follow computer configuration Windows settings secure settings to find software restriction
policies and application control policies both mechanisms are available will run a brief demonstration
that will show you how easy it is to control programs run by users using software restriction policies.
The first thing to do is to create a new software restriction policy one click produces several results.
Above all we have now access to default security level configuration.
The default level is unrestricted this level specifies that all users may run all programs we mentioned
before that this level is not the default level that you would like to use in a real environment.
Would be preferable to use a disallowed level which means that users are not allowed to run anything
except for allowed programs.
There's also an intermediate security level basic user which applies to users but not to administrators.
It's a default level that was designed to convince administrators that this mechanism is really efficient
for this demonstration.
Will leave the unrestricted security level and block a specific program that we don't want users to
run to do this go to additional rules.
As you can see there are two rules already path rules that indicate system components there at the unrestricted
security level.
This means that programs that are registered in these locations are always allowed to be run this doesn't
apply to the entire system.
System components however are exempted in this way
will add a new rule because we're thinking of a specific program a specific version of a program.
Let's choose a rule that is as specific as possible a file hash rule a certificate rule might be similarly
efficient but if it's uncertain if a program is signed digitally we shouldn't use it.
If the program is not digitally signed the certificate rule is not going to work.
Since the rule will create will be an exception from a default security level it should be a disallowed
exception one of block all attempts to run the program.
Next you need to identify the program to select it.
You need to possess a copy an administrator must have access rights to a program that is to be blocked.
This could pose some problems at times.
Since this means that a local computer has to have installed programs that are used by all users in
this case we have a copy of such a program.
From now on the indicated file will not run it's been placed in the disallowed mode.
The program is now disallowed.
Unfortunately to exempt another program you need to repeat this procedure.
There's no generalization available.
Let's now enforce the implementation of the rules in this local computer
to do this.
Run a command line interface with additional administrative privileges of data security policy computer
security policies are checked at system startup policies that relate to users or check that log on.
Additional checks are performed in about 15 minute intervals.
As you can see below the policies have been successfully updated.
Let's not try to run a program that has been blocked on this computer.
The prompt a message does not stem from an access rights issue.
We have the access rights to run the file.
This however goes against the updated policies our permissions are irrelevant.
We remove the created rule examples and explore the other control technology application control policies
this feature is often referred to simply as Applecore.
Let's start with no rules at.
You can import a security policy prepared on another computer or create default rules default rules
or the three rules that we've mentioned in the theoretical part of this module.
The first rule allows everyone to run applications installed in the Program Files folder.
The second rule allows the system to operate while the third allows administrators to run all applications
and files whether or not you consider the rules necessary is immaterial
noted app blockers default operation employs a concept that was mentioned earlier.
You can create exceptions for specific applications that are allowed to run and not exceptions for applications
that are to be blocked.
The latter concept was implemented in software restriction policies.
Take a look at the plucker rule wizard.
You need to indicate an application and specify if an action for a rule is to allow or deny running
the application.
You also need to select what users the rule will apply to
in our case the rule will apply to all users.
Next you can specify how a program to which the rule will apply will be identified.
We'll select the publisher condition.
Let's see how this rule will work for Internet Explorer
will create a rule that applies to Internet Explorer 9.
This application is a part of the Windows operating system.
The publisher is Microsoft Corp..
You can change the scope of the rule though.
You can apply the rule to the ninth version and all newer versions this way you declare that you don't
trust the earlier versions of Internet Explorer.
You can also apply the rule to all versions of the application move the slider up to make the rules
less specific and reduce the scope to filename by moving the slider you can block all Windows system
components or all files that are digitally signed by Microsoft
as you can see.
Generalization is quite easy and the solution.
This is an advance over the previous control technology.
Additionally you can also create rule exceptions.
We won't create any exceptions.
The rule we created blocks all digitally signed files published by Microsoft.
The last feature will show is generating a set of rules for applications located in a specific folder
that are known to be trustworthy will automatically generate rules.
The generator rules will apply to the CIS internal suite user folder several programs are contained
in the folder.
We won't create a rule for each of them.
We'll indicate what rules are to be created.
If we're lucky and it turns out that the folder contains digitally signed files we can create a publisher
will.
This would be the best option.
You can also select to always create file hash rules.
There can be many such rules.
You can generalize them using the method just shown which will automatically reduce their number analysis
of the folder is completed.
It turns out that the total number of rules is 56 publish rules and one file hash rule
when you select a hash rule list.
You can see that it's a generalized file hash rule it applies to multiple files a single rule and relates
to all non signed files that can be run.
We have successfully generated a set of rules exceptions that allow some operations to be performed
earlier in the presentations.
We blocked the ability to install applications that we correctly did not consider to be necessary as
standard components used in our network.
Now we'll work with the type of rules called Windows Installer rules.
Remember that MSIE files are used for installation.
Let's try to create a new rule.
Pay attention to the fact that you can create default rules for all types.
Now we also could create default rules.
This would allow users to install digitally signed files or files that are located in the installer
folder administrators would be able to install anything assume that the first two rules don't meet our
requirements.
Because of this will remove them
now only administrators can install files will create a new rule now
will explicitly deny installing programs were also blocked from installing in the previous example.
Like before this will be a file hash rule you need to specify a file or a folder that contains more
than one file.
You should provide a name for the rule.
It's also good to describe it.
However we won't do this in the presentation we have successfully created a rule that explicitly denies
anyone including administrators the right to run a specified installation file.
You'll have to start the previously mentioned service and potentially reboot the computer to put this
rule into effect.
The service application identity is designed to identify software.
It stopped at the moment will switch the service into automatic startup mode and start it.
After applying these rules and a reboot we can be sure that the defined policy really works in a local
computer or a computer group.
If the rules pertain to more than one machine.