How to Restrict Access to Applications using AppLocker

Applocker allows an administrator to restrict other users’ accesses on certain applications in a shared PC. This is a great tool let’s say for a parent that wants to restrict their children’s access to certain applications.

Notes:

• Applocker is only available in Windows 7 Ultimate and Enterprise editions.


• Administrator access is necessary to make these changes

Accessing Applocker

1. Click Start and type gpedit.msc in the search field. This will open the Group Policy Editor.



2. In the Group Policy Editor window, go to Computer Configuration \ Windows Settings \ Security Settings \ Application Control Policies \ AppLocker
   
   



3. Under Configure Rule Enforcement section click Configure rule enforcement.
   
   



4. Now under AppLocker Properties window, tick the box beside Configured under Executable Rules. Click OK after.

Restricting Specific Applications from Running

1. After enabling Executable Rules above, you’ll be back in the Applocker’s screen in the Group Policy Editor window. From there, go to the Overview section and click Executable Rules.
   
   



2. If this is your first time accessing Applocker, then there won’t be any rules set. Right-click and select Create New Rule
   
   



3. This will open a wizard that will allow you to configure your rules. You can opt to disable this wizard in the future by ticking the “Skip this page by default”. In the same screen, select Permissions on the left pane.
   
   For the Action: Set it to deny
   For the User or Group: By default it is set to everyone.
   
   Hit Select then type the username(s) of the people that you want to restrict. After configuring, hit next.
   
   
   
   



4. In the Conditions window, you can set the primary conditions:
   
   Publisher: To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released
   
   Path: Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted).
   
   File hash: Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is unique to that the version of the file
   
   Conditions reference
   
   
   
   
   
   The simplest of the three is path since you just need to specify the file location of the application you want to restrict. As described above, any subdirectory in that path will affected unless you explicitly set exemptions. For demonstration, I’ll just select Path as my primary condition. Click next when ready.
   



5. In the Path window, you can specify a file only or a folder. Usually, restricting a file is safer but the restriction will be lax. Restricting folder is usually the way to go but you need to be careful not to restrict any important subdirectories that the user(s) may need unless you’re restricting a game folder.
   
   



6. After selecting the path, you can hit Create to set the rule or click next to add Exemptions. After clicking next, a popup window will appear. Click Yes.
   
   
   
   
   You’ll now see the restrictions in place. From there, you can delete or modify the set rule(s).
   

Reference