[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Create AppLocker rule in GPO for a local user account

Posted on 2015-01-30
3
Medium Priority
?
685 Views
Last Modified: 2015-02-06
I would like to create an applocker rule in a GPO that applies to a local user that has been created on a group of machines.  When I assign an applocker rule, it doesn't let me enter a user, but forces me to select a domain user or a local user that exists on the machine I am using to edit the GPO.

I tried just creating the user on my machine I am using to edit the GPO, but it seems to tie the rule to the SID for that account on that computer which certainly wouldn't be the same SID on all of the other computers.  They would have different SID's for the local account.

How can I apply an applocker rule to a local user in a GPO?
0
Comment
Question by:gacus
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 40580645
you can't create a GPO for a local account
GPO is applied to an OU which implies domain accounts
0
 
LVL 1

Author Comment

by:gacus
ID: 40580660
That is not true.  GPO apply to either to computers or users(domain accounts).  In this case the Applocker policy applies to the computer machine policy.  Within the Applocker policy rules you can select the users that this applies to.  You can clearly select "Everyone" which includes local users and the (LOCAL) BUILTIN\Administrator.  I just want to specify a different local account.

All of my computers that I am referring to are joined to the domain and I am applying the policy to the machine.
0
 
LVL 38

Accepted Solution

by:
Mahesh earned 2000 total points
ID: 40582766
You can't apply to Applocker rule to single local user account from domain based GPO

Your rule will be applied to all local users including administrator on specific group of machines (when you apply rule to everyone) and to domain users who will logon to those machines

Even if you use conventional software restriction policies, it will behave in same way
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A hard and fast method for reducing Active Directory Administrators members.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question