Administering AppLocker
发布时间: 2012年4月
更新时间: 2012年6月
应用到: Windows 8, Windows Server 2012
This topic provides links to specific procedures to use when administering AppLocker policies and rules in Windows Server 2012 and Windows 8.
AppLocker helps administrators control how users can access and use files, such as executable files, packaged apps, scripts, Windows Installer files, and DLLs. Using AppLocker, you can:
-
Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file.
-
Assign a rule to a security group or an individual user.
-
Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe).
-
Use audit-only mode to deploy the policy and understand its impact before enforcing it.
-
Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, the existing policy is overwritten.
-
Simplify creating and managing AppLocker rules by using AppLocker PowerShell cmdlets.
 备注 |
|---|
| For more information about enhanced capabilities of AppLocker to control Windows apps, see AppLocker 中的打包应用和打包应用安装程序规则. |
The following topics are included to administer AppLocker:
-
Maintain AppLocker Policies
-
Edit an AppLocker Policy
-
Test and Update an AppLocker Policy
-
Deploy AppLocker Policies by Using the Enforce Rules Setting
-
Use the AppLocker Windows PowerShell Cmdlets
-
Optimize AppLocker Performance
-
Monitor Application Usage with AppLocker
-
Use AppLocker and Software Restriction Policies in the Same Domain
-
Manage Packaged Apps with AppLocker
-
How to work with policies
-
Configure an AppLocker Policy for Audit Only
-
Configure an AppLocker Policy for Enforce Rules
-
Display a Custom URL Message When Users Try to Run a Blocked Application
-
Export an AppLocker Policy from a GPO
-
Export an AppLocker Policy to an XML File
-
Import an AppLocker Policy from Another Computer
-
Import an AppLocker Policy into a GPO
-
Merge AppLocker Policies by Using Set-ApplockerPolicy
-
Merge AppLocker Policies Manually
-
Refresh an AppLocker Policy
-
Test an AppLocker Policy by Using Test-AppLockerPolicy
-
Configure an AppLocker Policy for Audit Only
-
How to work with rules
-
Create a Rule That Uses a File Hash Condition
-
Create a Rule That Uses a Path Condition
-
Create a Rule That Uses a Publisher Condition
-
Create AppLocker Default Rules
-
Configure Exceptions for an AppLocker Rule
-
Create a Rule for Packaged Apps
-
Delete an AppLocker Rule
-
Edit AppLocker Rules
-
Enable the DLL Rule Collection
-
Enforce AppLocker Rules
-
Run the Automatically Generate Rules Wizard
-
Create a Rule That Uses a File Hash Condition
You can administer AppLocker policies by using the Group Policy Management Console to create or edit a Group Policy Object (GPO), or to create or edit an AppLocker policy on a local computer by using the Local Group Policy Editor snap-in or the Local Security Policy snap-in.
You must have Edit Setting permission to edit a GPO. By default, members of the Domain Admins group, the Enterprise Admins group, and the Group Policy Creator Owners group have this permission. Also, the Group Policy Management feature must be installed on the computer.
-
在“开始”屏幕上，键入 gpmc.msc or open the Group Policy Management Console (GPMC).
-
Locate the GPO that contains the AppLocker policy to modify, right-click the GPO, and click Edit.
-
In the console tree, double-click Application Control Policies, double-click AppLocker, and then click the rule collection that you want to create the rule for.
-
在“开始”屏幕上，键入 secpol.msc or gpedit.msc.
-
如果出现了“用户帐户控制”对话框，请确认其所显示的操作是你要采取的操作，然后单击“是”。
-
In the console tree of the snap-in, double-click Application Control Policies, double-click AppLocker, and then click the rule collection that you want to create the rule for.
For how-to information about administering AppLocker with Windows PowerShell, see Use the AppLocker Windows PowerShell Cmdlets. For reference information and examples how to administer AppLocker with Windows PowerShell, see the AppLocker PowerShell Command Reference.
