AppLocker Publisher Rule "Exceptions" Bug?

Discussion in 'other software & services' started by wat0114, Sep 15, 2011.

Thread Status:
Not open for further replies.
  1. wat0114

    wat0114 Guest

    Normally I don't use Exceptions in any of my rules, but I just wanted to experiment with them, and while doing so discovered what might be a bug or an oversight on my part. Hopefully aomeone using Publisher rules in AppLocker can try thie following:

    See if you have a publisher rule for the Microsoft windows Operating System as seen in the first screenshot. I have it applied for "Users" and I run as a Standard users.

    Add a "Publisher" Exception to it and choose solitaire.exe found under C:\Program Files\Microsoft Games\Solitaire

    As seen in the second shot, you should have the same "File version", "Product name" and "Publisher" but the 'file name" should be solitaire.exe. Please also note the slider is at the bottom.

    Apply the rule and Okay, then try launching solitaire from the Start menu shortcut. I believe it should not run but it does for me o_O

    Now highlight the Exception rule and select "Edit". Do you see the same thing I do as seen in the 3rd screen shot? Note the slider at the very top which indicates it applies to "All signed files from any publisher".

    It seems as though it's setting the slider to the top whereas it should remain at the botton and this is preventing the exception from working. At least that's how I perceive it. Is anyone seeing the same anomaly and any thoughts on what's going on here? A bug maybe?

    Thanks!

    EDIT

    I don't know why my screenshots get scrambled in the wrong order all the time. It's infuriating :mad: The 3rd shot ended up first, so please take note.
     

    Attached Files:

  2. wat0114

    wat0114 Guest

    A little more sifting through the rules and I've discovered what happened :) I had a rule almost identical to the Microsoft Windows Operating System one with file version 6.1.0.0 generated from within Program Files directory except it was 0.3.0.0, this latter rule generated from within the Windows directory. Somehow this second rule with the lower file version signature can override the exception with the higher file version signature o_O Once I deleted the latter rule, the exception enforced and I can't open solitaire as expected. I'm not sure why it works this way but that's what it was.

    I even tried moving the slider for the exception up to the File name but that didn't help.

    Trouble is this latter rule probably can't be deleted by anyone wanting to create an exception similar to mine because there must have been a file(s) that is/are signed with this file version.
     
  3. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    AppLocker isn't without its oddities. :D I've experienced quite a few myself as well.
     
  4. wat0114

    wat0114 Guest

    True, although I've found after thoroughly researching, that there's always a logical, or at least somewhat logical, reason for any anomaly I've ever come across.
     
  5. 1chaoticadult

    1chaoticadult Registered Member

    Joined:
    Oct 28, 2010
    Posts:
    2,248
    Location:
    Chaotic Land
    I've also had oddities with applocker when I used it the first time. I didn't bother to take the time and research the issue at the time. But this time a round, I solved my issue and its fine.
     
Loading...
Thread Status:
Not open for further replies.