It's not possible to restrict to signed binaries in general, as far as I know. However, if you wish to be able to define specific binaries and/or publishers (i.e. signed binaries from a specific vendor), that is possible. This can be done through AppLocker. Apparently it's only enforced in Windows 7 Enterprise and Ultimate, and Windows Server 2008.
While you can create AppLocker rules on computers running Windows 7 Professional, they will not be enforced on those computers. However, you can create the rules on a computer running Windows 7 Professional and then export the policy for implementation on computer running an edition of Windows that does support AppLocker rule enforcement.
Basically, it's set through Group Policy. I'll walk you through a relatively simple setup here.
Open Group Policy editor (requires Professional, Enterprise or Ultimate).
gpedit.msc in the start menu will do.
Expand and navigate to
Local Computer Policy >
Computer Configuration >
Windows Settings >
Security Settings >
Application Control Policies >
AppLocker on the left.
Create a new rule through the
Action or right click menu. First, you'll want to create default rules. All executables in Windows and Program Files are allowed by default, use NTFS permissions to make sure only administrators (and system, etc, just not normal users) have write permissions to those folders, otherwise users could dump their unsigned executables in there and run them. We have to allow everything already in there, otherwise your OS will break.
The default rule action is to run only those applications that are specifically allowed in the AppLocker rule collection. While there is no setting to configure the default rule behavior, you can use AppLocker's default rule collection to override the default rule behavior. To do this, create an allow rule with a path condition set to *. This configuration will allow all files to run. You can then create deny rules to block specific files.
Create a the new rule. Use it to allow a publisher or file hash. You need an example for either of those.
Quoting the Microsoft article's FAQ:
Publisher rule conditions can only be used for files that are digitally signed by a software publisher. This condition type uses the digital certificate (publisher name and product name) and properties of the file (file name and file version). This type of rule can be created for an entire product suite, which allows the rule in most cases to still be applicable when the application is updated.
Path rule conditions are based on the file or folder installation path of specific applications.
File hash rule conditions are based on the unique file hash that Windows cryptographically computes for each file. This condition type is unique, so each time that a publisher updates a file, you must create a new rule.
- I wouldn't use path, unless write access is denied to those you are trying to block.
I don't have a current installation of Enterprise or Ultimate to check on, but I believe you have to enable AppLocker, above the Executable Rules (Configure AppLocker Enfocement?).
An alternative method is to only allow unsigned executables to be run as a basic user, i.e. disable UAC elevation for unsigned files. This is also done through the group policy, User Account Control: Only elevate executables that are signed and validated.
This has the inherent weakness of users being able to self-sign files. Malware can also possibly be signed with a generic certificate, which is why AppLocker (and Software Restriction Policy for pre-7) is so much more secure.