Application rules include: 1. Certificate rules, which can identify software through signature certificates; 2. Hash rules, used to uniquely identify a certain software program or file; 3. Internet zone rules, only applicable to " Windows Installer" package; 4. Path rules, identifying software based on its file path.
The operating environment of this tutorial: Windows 7 system, Dell G3 computer.
Using software restriction policies, you can protect your computing environment from untrusted software by identifying and specifying which software is allowed to run. You can define the default security level of a Group Policy object as Unrestricted or Not Allowed (GPO) so that software is allowed or not allowed to run by default. You can make exceptions to this default security level by creating software restriction policy rules for specific software. For example, when the default security level is set to "Don't allow," you can create rules that allow specific software to run. The types of rules are as follows:
1. Certificate rules
Software restriction policies can also identify software through signed certificates. You can create a certificate rule to identify software and then allow or disallow that software to run based on the security level. For example, you can use certificate rules to automatically trust software from trusted sources in your domain without prompting the user. You can also use certificate rules to run files in disallowed areas of the operating system. By default, certificate rules are not enabled.
When using Group Policy to create rules for a domain, you must have permission to create or modify Group Policy objects. If you want to create a rule for a local computer, you must have administrative credentials on that computer.
2. Hash rules
A hash is a series of bytes with a fixed length that is used to uniquely identify a software program or file. The hash is calculated by a hashing algorithm. After you create a hash rule for a software program, the software restriction policy calculates the program's hash. When a user attempts to open a software program, the program's hash is compared to the existing hash rules of the software restriction policy. No matter where a software program is located on your computer, the program's hash is always the same. However, if the software program is changed in any way, its hash changes and no longer matches the hash in the software restriction policy's hash rules.
For example, you can create a hash rule and set the security level to "Do Not Allow" to prevent users from running specific files. A file can be renamed or moved to another folder and the hash remains the same. However, if any changes are made to the file, it will also change its hash and allow it to bypass the restriction.
3. Internet zone rules
Internet zone rules only apply to Windows Installer packages. Zone rules identify software in a zone specified by Internet Explorer. These zones are Internet, Local Intranet, Restricted Sites, Trusted Sites, and My Computer. Internet zone rules are used to prevent users from downloading and installing software.
4. Path rules
Path rules identify software based on its file path. For example, if your computer's default security level is Not Allowed, you can still grant each user unrestricted access to a specific folder. You can create a path rule by using a file path and setting the path rule's security level to Unrestricted. Some common paths for this type of rules are %userprofile%, %windir%, %appdata%, %programfiles%, and %temp%. You can also create registry path rules that use the software's registry keys as its paths.
Because these rules are specified by path, if the software program is moved, the path rules will no longer apply.
For more computer-related knowledge, please visit theFAQcolumn!
The above is the detailed content of What are the application rules for software restriction policies?. For more information, please follow other related articles on the PHP Chinese website!