Testing Microsoft's Windows Application Whitelisting Tool

Fortunately, improved support for certificate-based software restriction policies is one of the enhancements that jumped out at me in the Windows 7 iteration of SRP, which will be known as AppLocker. AppLocker sports a new rules generation wizard that rolls up the different policy control types offered under previous SRP versions into a single process.

For instance, in order to allow all the applications and libraries under the Program Files directory of my test Windows 7 machine, I launched the automatic rulemaking tool, browsed to my Program Files directory, and selected the local users group as the set of users to be governed by my policy. On the next screen, Windows 7 gave me the option of creating certificate-based rules for all signed files, and of creating hash- or path-based rules for the unsigned files. I could also opt to create hashes of all files under Program Files.

The tool then told me how many files my new rule set would protect and how many rules the set would span, as well as offering me the option of reviewing the analyzed files and the yet-unmade rules before clicking create. If I wished to exclude some of the analyzed files from my policy, I could do so at this point.

Windows 7's overhauled SRP also allows administrators to determine how tightly to control subsequent versions of a given application. For instance, an administrator could allow all versions of an application signed by the same publisher to run, or could allow only applications with a particular version number to run.

AppLocker also allows administrators to export or import rule sets—a nice option to have if you plan on reusing policies or wish to have the option of rolling a modified or deleted rule set to an earlier version.

Microsoft's reworked SRP tools still have a few rough edges—AppLocker-specific help is nonexistent at this point, and the new AppLocker tools ride, confusingly, beside the old SRP-specific tools in Windows 7's secpol tool. However, given that the version of Windows 7 I used for testing is the PDC prebeta build, I was impressed by the relative completeness of the tools.

eWEEK Labs Executive Editor Jason Brooks can be reached at jbrooks@eweek.com.