Creating Your AppLocker Planning Document

  • Article

Updated: June 21, 2012

Applies To: Windows 7, Windows 8, Windows Server 2008 R2, Windows Server 2012

This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document.

The AppLocker deployment design

The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using AppLocker.

You should have completed these steps in the design and planning process:

  1. Determining Your Application Control Objectives

  2. Creating the List of Applications Deployed to Each Business Group

  3. Selecting the Types of Rules to Create

  4. Determining Group Policy Structure and Rule Enforcement

  5. Planning for AppLocker Policy Management

AppLocker planning document contents

Your planning document should contain:

  • A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information.

  • Application control policy project target dates, both for planning and deployment.

  • A complete list of applications used by each business group (or organizational unit), including version information and installation paths.

  • What condition to apply to rules governing each application (or whether to use the default set provided by AppLocker).

  • A strategy for using Group Policy to deploy the AppLocker policies.

  • A strategy in processing the application usage events generated by AppLocker.

  • A strategy to maintain and manage AppLocker polices after deployment.

Sample template for an AppLocker planning document

You can use the following form to construct your own AppLocker planning document.

Business group:

Operating system environment: (Windows and non-Windows)

Contacts

Business contact:

Technical contact:

Other departments

In this business group:

Affected by this project:

Security policies

Internal:

Regulatory/compliance:

Business goals

Primary:

Secondary:

Project target dates

Design signoff date:

Policy deployment date:

Rules

Business group Organizational unit Implement AppLocker? Applications Installation path Use default rule or define new rule condition Allow or deny GPO name Support policy

 

Event processing

Business group AppLocker event collection location Archival policy Analyzed? Security policy

 

Policy maintenance

Business group Rule update policy Application decommission policy Application version policy Application deployment policy

 

Planned:

Emergency:

Example of an AppLocker planning document

Rules

Business group Organizational unit Implement AppLocker? Applications Installation path Use default rule or define new rule condition Allow or deny GPO name Support policy

Bank Tellers

Teller-East and Teller-West

Yes

Teller Software

C:\Program Files\Woodgrove\Teller.exe

File is signed; create a publisher condition

Allow

Tellers-AppLockerTellerRules

Web help

Windows files

C:\Windows

Create a path exception to the default rule to exclude \Windows\Temp

Allow

Help desk

Human Resources

HR-All

Yes

Check Payout

C:\Program Files\Woodgrove\HR\Checkcut.exe

File is signed; create a publisher condition

Allow

HR-AppLockerHRRules

Web help

Time Sheet Organizer

C:\Program Files\Woodgrove\HR\Timesheet.exe

File is not signed; create a file hash condition

Allow

Web help

Internet Explorer 7

C:\Program Files\Internet Explorer\

File is signed; create a publisher condition

Deny

Web help

Windows files

C:\Windows

Use the default rule for the Windows path

Allow

Help desk

Event processing

Business group AppLocker event collection location Archival policy Analyzed? Security policy

Bank Tellers

Forwarded to: AppLocker Event Repository on srvBT093

Standard

None

Standard

Human Resources

DO NOT FORWARD. srvHR004

60 months

Yes, summary reports monthly to managers

Standard

Policy maintenance

Business group Rule update policy Application decommission policy Application version policy Application deployment policy

Bank Tellers

Planned: Monthly through business office triage

Emergency: Request through help desk

Through business office triage

30-day notice required

General policy: Keep past versions for 12 months

List policies for each application

Coordinated through business office

30-day notice required

Human Resources

Planned: Monthly through HR triage

Emergency: Request through help desk

Through HR triage

30-day notice required

General policy: Keep past versions for 60 months

List policies for each application

Coordinated through HR

30-day notice required

Additional resources