?
Solved

Create AppLocker rule in GPO for a local user account

Posted on 2015-01-30
3
Medium Priority
?
647 Views
Last Modified: 2015-02-06
I would like to create an applocker rule in a GPO that applies to a local user that has been created on a group of machines.  When I assign an applocker rule, it doesn't let me enter a user, but forces me to select a domain user or a local user that exists on the machine I am using to edit the GPO.

I tried just creating the user on my machine I am using to edit the GPO, but it seems to tie the rule to the SID for that account on that computer which certainly wouldn't be the same SID on all of the other computers.  They would have different SID's for the local account.

How can I apply an applocker rule to a local user in a GPO?
0
Comment
Question by:gacus
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 40580645
you can't create a GPO for a local account
GPO is applied to an OU which implies domain accounts
0
 
LVL 1

Author Comment

by:gacus
ID: 40580660
That is not true.  GPO apply to either to computers or users(domain accounts).  In this case the Applocker policy applies to the computer machine policy.  Within the Applocker policy rules you can select the users that this applies to.  You can clearly select "Everyone" which includes local users and the (LOCAL) BUILTIN\Administrator.  I just want to specify a different local account.

All of my computers that I am referring to are joined to the domain and I am applying the policy to the machine.
0
 
LVL 37

Accepted Solution

by:
Mahesh earned 2000 total points
ID: 40582766
You can't apply to Applocker rule to single local user account from domain based GPO

Your rule will be applied to all local users including administrator on specific group of machines (when you apply rule to everyone) and to domain users who will logon to those machines

Even if you use conventional software restriction policies, it will behave in same way
0

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
Suggested Courses

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question