Windows ecosystem generally works with 3 party applications easily while installing and running them. This creates some risk especially for the novice users. Windows administrators generally want to restrict users applications and executables to make their operating system more secure.

(資料圖片僅供參考)

Windows生態(tài)系統(tǒng)通常可以在安裝和運行3方應(yīng)用程序時輕松使用。 尤其是對于新手用戶，這會帶來一些風(fēng)險。 Windows管理員通常希望限制用戶的應(yīng)用程序和可執(zhí)行文件，以使其操作系統(tǒng)更安全。

Windows recently launched a feature named AppLocker. As its name suggests it simply restricts the executables and applications those can run on the system or user account.

Windows最近啟動了名為AppLocker的功能。 顧名思義，它只是限制了可以在系統(tǒng)或用戶帳戶上運行的可執(zhí)行文件和應(yīng)用程序。

特征 (Features)

Applocker provides different restrictions according to following situations.

Applocker根據(jù)以下情況提供不同的限制。

Which user have access to the application?哪個用戶有權(quán)訪問該應(yīng)用程序？ Which users can install new application?哪些用戶可以安裝新應(yīng)用程序？ Which application versions can be installed?可以安裝哪些應(yīng)用程序版本？ How to audit licensed application?如何審核許可的申請？

白名單申請 (White Listing Application)

In security world there is very popular technique named While Listing. A list of software that is secure and approved is created and only this list or inventory includes applications can be installed in to the systems. Other applications are prohibited from installed unless not excepted.

在安全世界中，有一種非常流行的技術(shù)，稱為While Listing。 將創(chuàng)建一個安全且已批準(zhǔn)的軟件列表，并且只有此列表或清單中包含應(yīng)用程序的軟件才能安裝到系統(tǒng)中。 除非沒有其他限制，否則禁止安裝其他應(yīng)用程序。

建立規(guī)則 (Create A Rule)

Now action starts. We will create a rule to give permission to an application to run on the windows system.

現(xiàn)在開始行動。 我們將創(chuàng)建一個規(guī)則，以授予在Windows系統(tǒng)上運行的應(yīng)用程序權(quán)限。

打開本地組策略編輯器 (Open Local Group Policy Editor)

The new rules will be created with Local Group Application Editor. So we will open this editor easily by running following command in Windows run.

將使用“本地組應(yīng)用程序編輯器”創(chuàng)建新規(guī)則。 因此，我們將通過在Windows run中運行以下命令來輕松打開此編輯器。

gpedit.msc

打開創(chuàng)建新規(guī)則表格 (Open Create New Rule Form)

We will navigate to the Applocker section with Computer Configuration-> Windows Settings-> Security Settings-> Application Control Policies

我們將通過Computer Configuration-> Windows Settings-> Security Settings-> Application Control Policies導(dǎo)航到Applocker部分

Open Create New Rule Form打開創(chuàng)建新規(guī)則表格

點擊下一步(Click Next)

Nothing else matters ??

沒關(guān)系matters

Click Next點擊下一步

決定行為(Decide Behaviour)

We should decide the behaviour of the executable in this page. We simply allow application. Also we can select the users the rules will be applied. In this situations by  default Everyone

我們應(yīng)該在此頁面中確定可執(zhí)行文件的行為。 我們只允許申請。 我們也可以選擇將應(yīng)用規(guī)則的用戶。 在這種情況下，默認(rèn)情況下Everyone

Decide Behaviour決定行為

提供可執(zhí)行規(guī)則條件(Provide Executable Rule Condition)

One of the most important part is this step. We will define and identify the application we want to rule. There is 3 type of identification technique.

最重要的部分之一是此步驟。 我們將定義并標(biāo)識我們要統(tǒng)治的應(yīng)用程序。 識別技術(shù)有3種類型。

Publisherinformation is gathered from executable verified Published meta data.

Publisher信息是從可執(zhí)行的經(jīng)過驗證的發(fā)布元數(shù)據(jù)中收集的。

Pathinformation is simply from which location the executable resides.

Path信息只是可執(zhí)行文件所在的位置。

File hashis a unique value describes the application

File hash是描述應(yīng)用程序的唯一值

LEARN MORE  How To Prevent SQL Injection in Php Applications?

了解更多信息如何防止在PHP應(yīng)用程序中進(jìn)行SQL注入？

We will use file hash in this example.

在此示例中，我們將使用文件哈希。

Provide Executable Rule Condition提供可執(zhí)行規(guī)則條件

指定可執(zhí)行文件(Specify Executable File)

In this step we will select executable files one by one or by specifying the directory the executables located. As an example we have selected 7zapplication. These files hashes will be calculated automatically and stored in the created rule.

在這一步中，我們將一一選擇可執(zhí)行文件，或者通過指定可執(zhí)行文件所在的目錄來選擇可執(zhí)行文件。 作為示例，我們選擇了7z應(yīng)用程序。 這些文件哈希將自動計算并存儲在創(chuàng)建的規(guī)則中。

Specify Executable File指定可執(zhí)行文件

提供規(guī)則名稱和描述(Provide Rule Name and Description)

As the rule vault grows and become bigger management of these rules become a nightmare. So we should select a name which is identifiable. Also we can put some description about rule.

隨著規(guī)則庫的增長和擴(kuò)大，對這些規(guī)則的管理成為一場噩夢。 因此，我們應(yīng)該選擇一個可識別的名稱。 我們也可以對規(guī)則進(jìn)行一些描述。

Provide Rule Name and Description提供規(guī)則名稱和描述

And click to Createbutton on the left bottom side.

然后單擊左下方的Create按鈕。

創(chuàng)建默認(rèn)規(guī)則 (Create Default Rules)

After click create we will get a warning stating that in order to prevent unexpected problems we should add default rules which are used to give required permissions to the Everyone and builtin administrators.

單擊“創(chuàng)建”后，我們將收到一條警告，指出為防止意外問題，我們應(yīng)添加默認(rèn)規(guī)則，這些規(guī)則用于向所有人和內(nèi)置管理員提供必需的權(quán)限。

Create Default Rules創(chuàng)建默認(rèn)規(guī)則

After clicking Yesfollowing rule list will appear

單擊“ Yes后，將顯示以下規(guī)則列表

Rule List規(guī)則清單

通過執(zhí)行啟用Applocker規(guī)則(Enable Applocker Rules With Enforcement)

We have created our rule but is it enabled and works as we expect? Not because we should enable the AppLocker rules from its properties.

我們已經(jīng)創(chuàng)建了規(guī)則，但是該規(guī)則已啟用并且可以按預(yù)期工作嗎？ 不是因為我們應(yīng)該從其屬性啟用AppLocker規(guī)則。

打開Applocker屬性 (Open Applocker Properties)

We can open Applocker properties window like below.

我們可以打開如下所示的Applocker屬性窗口。

啟用規(guī)則 (Enable Rules)

We will just enable Configuredcheckbox of Executable ruleslike below and then select Enforce rulesand click Apply .

我們將僅啟用如下所示的“ Executable rulesConfigured復(fù)選框，然后選擇“ Enforce rules并單擊“ Apply。

I suggest you that for the first time for a little time select Auditonly. This will not enforce rules but create logs about the rules and give hints how it works and prevent accidents and lockdown.

我建議您第一次選擇“僅Audit。 這不會強(qiáng)制執(zhí)行規(guī)則，但會創(chuàng)建有關(guān)規(guī)則的日志，并提示它如何工作并防止事故和鎖定。