Microsoft AppLocker is a powerful feature that allows organizations to control which applications can run on their systems. When used in combination with VMware Workspace ONE UEM, it provides an additional layer of security for none domain join laptops. In this blog post, we will explore how to configure AppLocker to allow users to launch .EXE files only from the Program Files and Windows directory, while administrators are allowed to launch .EXE files in all directories.

Step 1: Create a Rule

To begin, open the AppLocker settings in your VMware Workspace ONE UEM environment. Click on the “Policies” tab and then click on the “Create Policy” button. Give the policy a name that describes its purpose, such as “Allowed EXE Files.”

Step 2: Add Rules

In the “Create Policy” window, scroll down to the “Rules” section and click the “Add Rule” button. In the “Rule Conditions” section, select “File Name” and then enter the following conditions:

* File Name: *.EXE

* File Location: Program Files, Windows

These conditions will allow only .EXE files to be executed, and limit them to the Program Files and Windows directories.

Step 3: Add Exceptions

Next, you need to add some exceptions to the rule. In the “Rule Actions” section, click the “Add Action” button and select “Allow.” Then, enter the following conditions:

* File Name: *.EXE

* File Location: Anywhere

These conditions will allow administrators to launch .EXE files in all directories.

Step 4: Save the Policy

Once you have added all the rules and exceptions, click the “Save” button to save the policy. You can now associate this policy with the appropriate users or groups in your VMware Workspace ONE UEM environment.

Configuring AppLocker in combination with VMware Workspace ONE UEM provides an additional layer of security for none domain join laptops. By allowing only .EXE files to be executed from the Program Files and Windows directories, you can limit the potential damage that can be caused by malicious software. Additionally, by allowing administrators to launch .EXE files in all directories, you ensure that they have the flexibility they need to perform their tasks effectively.

In conclusion, configuring AppLocker in combination with VMware Workspace ONE UEM is a powerful way to control which applications can run on your systems. By following the steps outlined in this blog post, you can create a policy that allows users to launch .EXE files only from the Program Files and Windows directory, while administrators are allowed to launch .EXE files in all directories. This provides an additional layer of security for none domain join laptops, while still allowing administrators the flexibility they need to perform their tasks effectively.