🔐 Securing Application Access via Group Policy (GPMC)

🎯 Introduction

This guide outlines how to restrict or control the applications that users can run in a Windows domain environment using Group Policy Management Console (gpmc.msc). The goal is to enhance security on domain-joined machines and the Remote Desktop server (server1.cloud.domain.com.au) by limiting user access to approved applications only, or by explicitly blocking known security risks. This is particularly useful in environments where users access systems remotely or via terminal sessions, and where tighter control over application execution is required.

💪 Prerequisites

• You must have Domain Admin rights.

• You are editing Group Policy using gpmc.msc on a Domain Controller.

• Your environment includes:

  • A domain controller server1.cloud.domain.com.au

  • Windows domain-joined computers

  • Users connecting via RDP to server1

🧱 STEP 1: Create a New Group Policy Object (GPO)

1. Open Group Policy Management Console (gpmc.msc)

2. Navigate to:

   Forest: cloud.domain.com.au > Domains > cloud.domain.com.au
   

3. Right-click Group Policy Objects > New

4. Name the new policy:

   App Restrictions Policy
   

5. Click OK

🪩 STEP 2: Link the GPO

Option A: Link at Domain Level (applies to all domain users and computers)

• Right-click the domain cloud.domain.com.au

• Choose Link an Existing GPO...

• Select App Restrictions Policy

Option B: Link to Specific OUs (recommended for fine control)

• Right-click the OU(s) for:

  • Remote Desktop Servers (containing server1)

  • Domain Workstations

• Choose Link an Existing GPO...

• Select App Restrictions Policy

❌ OPTION 1: Block Specific Applications (Blacklist)

1. Right-click App Restrictions Policy > Edit

2. Navigate to:

   User Configuration > Administrative Templates > System
   

3. Double-click Don't run specified Windows applications

4. Set to Enabled

5. Click Show... and list apps to block:

   cmd.exe
   powershell.exe
   regedit.exe
   nmap.exe
   wireshark.exe
   

6. Click OK > Apply

✅ OPTION 2: Only Allow Specific Applications (Whitelist)

1. In the same GPO editor, go to:

   User Configuration > Administrative Templates > System
   

2. Double-click Run only specified Windows applications

3. Set to Enabled

4. Click Show... and list only approved apps:

   explorer.exe
   chrome.exe
   yourapp.exe
   notepad.exe
   

5. Click OK > Apply

🔐 OPTION 3: AppLocker (Advanced Control)

Step 1: Enable Application Identity Service

On all target computers including server1:

1. Run services.msc

2. Find Application Identity

3. Set Startup Type to Automatic, then Start it

Step 2: Create AppLocker Rules

1. In App Restrictions Policy, navigate to:

   Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker
   

2. Right-click Executable Rules > Create Default Rules

   • Allows essential system operations

3. To deny specific applications:

   • Right-click Executable Rules > Create New Rule

   • Action: Deny

   • User or Group: Domain Users

   • Condition: Path

   • Path: C:\Program Files\Nmap\nmap.exe

4. To allow a specific app:

   • Action: Allow

   • Path: C:\Program Files\YourApp\yourapp.exe

5. Set AppLocker to enforce rules:

   • Right-click AppLocker > Properties

   • Set Executable Rules to Enforce Rules

↺ STEP 3: Apply and Test

1. Run the following on all target machines:

   gpupdate /force
   

2. Confirm with:

   gpresult /h result.html
   start result.html
   

3. AppLocker logs can be viewed in Event Viewer:

   Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL
   

🔧 Notes

• Use Security Filtering to target specific user groups or computers

• Test policies in a small OU before full deployment

• Combine AppLocker with Group Policy for tighter control

• Maintain a fallback local admin account to avoid lockout