Determine AppLocker mode?

[clicked]

This is tangentially an AutoIt question. AppLocker can run in "Audit only" mode or "Enforce rules" mode. I can't find any scriptable way to determine this setting. The Powershell AppLockerPolicy Cmdlets are for checking files and rules, but not AppLocker mode. Is there a Windows API call or something that can determine this?

[Tripredacus]

What I would do is get a test system together, using a VM or whatever you want. Install 7 Enterprise. Create an AppLocker rule for something like calc.exe, run ProcMon and enable the Enforce Rules mode. Stop ProcMon and look for any registry entries it may have set for it. Otherwise, you can dig around in WMI to see if the setting is recorded there.

[clicked]

Thanks, those are good suggestions. It provoked me into a quick "applocker registry" and "applocker wmi" search, which produced nothing. So I guess if there is a way, and there may not be, it will involve digging around the hard way and find a visible setting that Windows changes for AppLocker enforcement, just like you suggest.

[Tripredacus]

Thanks, those are good suggestions. It provoked me into a quick "applocker registry" and "applocker wmi" search, which produced nothing.

Of course! I looked around google for about 10 minutes before giving up and making my post.

[clicked]

Of course! I looked around google for about 10 minutes before giving up and making my post.

My comment didn't come over like I wanted it to. I actually didn't think of googling applocker registry settings or wmi, so I am grateful for your suggestion. Thanks again. Edited October 20, 2012 by clicked

[clicked]

Solved,

Just export the policy as XML. The XML file contains an indication of audit-only or enforcement for each policy type (exe, dll, script, installer).

[careca]

May i add that all changes you have done in applocker will be saved under the registry key:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionGroup Policy Objects{009EA05A-7976-4BCE-B4ED-1CF105DB5402}MachineSoftwarePoliciesMicrosoftWindowsSrpV2

There are 3 more keys under this, they correspond to the exe, msi and script rules.

EDIT: fyi found this with the nice tool, RegFromApp, traces the changes made by a specific process.

When this doesn't work by some reason i use ProcessMonitor AKA ProcMon

Edited November 5, 2012 by careca