-: In this demonstration, I'm going to show you
how to use the Local Group Policy editor
to set up some various configurations for your machine.
We're going to use a Windows 10 workstation
here as our example machine.
And we're going to go and do an application whitelist
and an application blacklist using the Group Policy editor.
To access the Group Policy editor,
we simply need to go and start up the gpedit program.
We'll go ahead and use Edit group policy.
Let me go ahead and make this larger.
You'll see down the left side
all of the various configurations we can do
on a per user or per computer basis.
We're going to start with the per computer basis
with Windows Settings.
Next, we're going to look at the Security Settings.
Under here, we have Account Policies,
which show our Password Policies,
as well as Local Policies,
which allows us to do Auditing,
User Rights, and Security Options.
What I want to focus on here is application control.
So, we're going to go to our Application Control Policies,
which will allow us to create whitelists and blacklists.
Go ahead and hit the down arrow.
You'll see we have AppLocker.
AppLocker will allow us
to create different rules for installers,
for scripts, for packaged apps,
and what we're going to use right now,
which is executable rules.
Underneath the Executable Rules,
you will see we currently have no items listed,
because this is a brand new computer.
I'm going to create a whitelist here
and allow a certain application to be run.
To do that, we simply right click and Create a New Rule.
From here, we are going to be able
to walk through the wizard
and you'll set up your permissions.
Is this going to be an Allow rule?
Meaning it's a whitelist rule.
Or a Deny rule?
Meaning it's a blacklist rule.
In my case, I'm going to create a Deny rule
and I'm going to blacklist a program.
Next, we're going to say
what conditions are going to be met.
Is it based on the person who wrote it, the Publisher?
Like I can block all programs that were made by Microsoft
or by Adobe, if I wanted to.
Or is it based on Path, a certain file, and folder name?
Or if it's a piece of malware,
you might want to do it based on File hash,
because every file has its own unique hash,
as we'll talk about when we get to hashes and cryptography.
But right now, I'm going to use the Path option
just to show you how this works, for an example.
Next, we're going to find that file.
You can browse and you can block things based
on the folder it sits in or a particular file.
For example, I might want to make it
so that nobody can run any files out of the C drive
and under the Temp folder,
which is underneath the Windows folder.
So, if I go and click down there,
I'll find the Temp folder and then I'll hit okay.
This says that anything that's trying to be run
out of the temporary directory is not going to be allowed.
This is actually a good rule to set up,
because a lot of malware likes to try to run
out of the Temp folder.
Then we'll go ahead and hit next
and you'll see that we have
whatever exceptions we want to do.
Maybe I want to say that I will allow nothing
to run out of the Temp folder except for Microsoft.
I can actually browse through
and find that reference file for Microsoft.
In my case, I'm going to block everything
coming from that Temp folder
and I'm going to give it a rule.
The rule name is going to be
Block Files from running out of temp directory.
This is just used to give you a way to remember
what this rule is used for.
You can now see that by default,
everyone is allowed.
You can now see that by default,
everyone is allowed to let anything run
from the Programs folder.
They can also allow anything to be run
from the Windows folder and they allow all file,
but everyone is being blocked
from running out of the Temp directory.
That's the way we create whitelist and blacklist rules.
In this example,
I showed you a blacklist rule,
but you can go through and play around with it
and do the exact same thing to put whitelist rules
where you deny everything by default
and only allow specific programs
and files that you specify.