I tested applocker publisher deny rule on Mozilla Firefox, Opera and Google Chrome by denying executions of these browsers. What I did was, I installed these browsers on one Win7 machine, and throug it, I created publisher rules by browsing to executables,
so Group Policy automatically recognized publishers.
This group policy are now applied to this computer, but I can still launch all these browsers. But as in technet is written, "Publisher conditions can be made only for files that are digitally signed; this condition identifies an application based on its digital signature and extended attributes.". Here my understanding stops. Can I somehow apply these digital significations?
Below is the excutable policy:
Deny Everyone Signed by O=OPERA SOFTWARE ASA, S=OSLO, C=NO Publisher No
Deny Everyone Signed by O=MOZILLA CORPORATION, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US Publisher No
Deny Everyone GOOGLE CHROME, from O=GOOGLE INC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US Publisher No
Allow BUILTIN\Administrators All files Path No
Allow Everyone (Default Rule) All files located in the Program Files folder Path No
Allow Everyone (Default Rule) All files located in the Windows folder Path No
This group policy are now applied to this computer, but I can still launch all these browsers. But as in technet is written, "Publisher conditions can be made only for files that are digitally signed; this condition identifies an application based on its digital signature and extended attributes.". Here my understanding stops. Can I somehow apply these digital significations?
Below is the excutable policy:
Deny Everyone Signed by O=OPERA SOFTWARE ASA, S=OSLO, C=NO Publisher No
Deny Everyone Signed by O=MOZILLA CORPORATION, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US Publisher No
Deny Everyone GOOGLE CHROME, from O=GOOGLE INC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US Publisher No
Allow BUILTIN\Administrators All files Path No
Allow Everyone (Default Rule) All files located in the Program Files folder Path No
Allow Everyone (Default Rule) All files located in the Windows folder Path No