Application whitelisting in Windows 7 and Windows Server 2008 R2

Microsoft's AppLocker, the application control feature included in Windows 7 and Windows Server 2008 R2, is an improvement on the Software Restriction Policies (SRP) introduced with Windows XP Professional. AppLocker allows application execution rules and exceptions to them to be defined based on file attributes such as path, publisher, product name, file name, file version, and so on. Policies can then be assigned to computers, users, security groups, and organizational units through Active Directory.

Reporting is limited to what can be pulled from log files, and creating rules for file types not defined in AppLocker can be difficult. But AppLocker's biggest drawback is that it's limited to Windows 7 Enterprise, Windows 7 Ultimate, and Windows Server 2008 R2 clients. Windows 7 Professional can be used to create policy, but cannot use AppLocker to enforce rules on itself. AppLocker cannot be used to manage earlier versions of Windows, although both Windows XP Pro's SRP and AppLocker can be similarly configured to affect an enterprise-wide policy.

[ Read the Test Center review of application whitelisting solutions from Bit9, CoreTrace, Lumension, McAfee, SignaCert, and Microsoft. Compare these application whitelisting solutions by the features. ]  

AppLocker can be configured locally using the Local Computer Policy object (gpedit.msc) or using Active Directory and Group Policy Objects (GPOs). Like a lot of Microsoft's latest Active Directory-enabled technologies, administrators will need at least one domain-joined Windows Server 2008 R2 or Windows 7 computer to define and administer AppLocker. Windows 7 computers will need the Group Policy Management console feature installed as part of the Remote Server Administration Tools (RSAT) for Windows 7 (a free download). AppLocker relies on the built-in Application Identity service, which is normally set to manual startup type by default. Administrators should configure the service to start automatically.

Within the local or group policy object, AppLocker is enabled and configured under the \Computer Configuration\Windows Settings\Security Settings\Application Control Policies container [screen image].