![]() If unable to use domain-based groups, you could run a script after your Windows service adds the user to a group.This would be the far better approach than the 'solution' below. These would be present before they log on, and their Kerberos token would be complete. Use domain-based security groups to assign users' access to applications.There would be multiple different solutions, depending on a lot of factors in your environment. ![]() Whenever any group-based operations are checked for a user (ACLs, AppLocker policies, etc), the thing that actually gets checked is their Kerberos token. At logon, a user's Kerberos token is generated based on a combination of their account SID and the SIDs of all groups that they are a member of. When you add a user to a group, their new group membership does not take effect until the next time they log on (while their account remains in that group). The reason this is failing when you rely on the automated application of this rule is because users are being added to groups after they have logged on. Or even just changing existing user group policy to point to specific user made it work and then changing back to point to user group not work again.įunny part - after a few VM restarts it worked again, and then next day when I wanted to demo it to a colleague, I got the same issue again, which again was solved by multiple VM restarts.Īn obvious possible issue could be 'does the user really belong to the group?' and the answer is yes: each time when the policy wouldn't work, I'd go into lusrmgr and verify that.įor additional context - the VM is hosted on Azure, running Windows 10 multi-session 21H1, AppLocker is setup on local machine level (no domain wide policies or anything like that atm). Then I tried creating user specific rule to allow chrome.exe, which worked fine and as soon as I removed it (group rule still exists), I'd get blocked again. I tested all policies combined via PowerShell commandlets, and according to them the user that belongs to the user group Chrome should be allowed to access chrome.exe, but in reality I'd get an app blocked prompt. That worked fine at first, but after a while it stopped (AppLocker itself worked, but user groups specific rules didn't apply-in other words, everything was blocked). The setup is that I have predefined AppLocker rules (for example, Allow windows user group 'Chrome' access 'chrome.exe' (not actual group name or actual path)) and then assigned users to groups at login with the help of a Windows service. I'm trying to make dynamic app blocking rules with AppLocker.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |