RUNDLL32.EXE

[amandaw33]

heads up for me blocking %SYSTEM32%\RUNDLL32.EXE by publisher caused pinned items to stop working on win10 1809.

thanks for all your work on these rules.

[api0cradle]

Thanks for the info. Note that blocking rundll32 is not supported and it is kinda expected that it will break something.

[amandaw33]

It's listed here, no? Sorry if I'm misunderstanding.

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/AppLocker-BlockPolicies/PublisherBlockRules-EXE.xml

[api0cradle]

[api0cradle]

I have added it, but I do not recommend the blocking rules to be used actively in production without proper testing since it might actually break stuff. The most scary binary is the rundll32 for sure

[amandaw33]

Thanks just wanted to make sure I wasn't misunderstanding the rules set. I did test, then moved it to prod and ran it for a week before anyone noticed 😁 cheers!