Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to disable portable applications using AppLocker?

share|improve this question
add comment

1 Answer

Yes. If you enable the default executable rules, only applications that are installed in Program Files / Program Files (x86) and Windows are allowed to execute for standard uses. Administrators get an override to run anything and therefore can install software.

Also consider enabling the DLL feature with the default ruleset. This prevents surprise DLL injection from happening. Despite the warning that DLL rules can affect performance, I can't tell a difference.

One gotcha is that Google Chrome, Amazon Kindle for PC, Cisco WebEx and Citrix GoToMeeting, etc. install themselves per-user into AppData or the global AppData folders which aren't allowed to exectute. All of these companies use code signing, so you can create publisher rules to trust code from Amazon, Cisco, Google, Citrix, etc.

I'd also consider enabling the script and installer rules. I like add a rule to Permit *.ps1 since PowerShell has its own script execution policy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.