Deny Policy for Users only

[krunph]

Hello @HotCakeX ,

Hope everything is well.

First of all, I’ve been using AppControl for almost a year now and it’s working perfectly — thanks for your great work!
I would like to create a deny policy for cmd.exe and powershell.exe that applies only to standard (non-admin) users.
Is there a way to target only these users and exclude administrators?
Thank you!

[Harvester57]

Hi @krunph,

Not with WDAC unfortunately, you'll have to deploy an AppLocker policy if you want per-user or per-group rules, as stated in the Microsoft documentation: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview#choose-when-to-use-app-control-or-applocker

[krunph]

Thanks @Harvester57 !

[HotCakeX]

Thank you, i'm glad it's working well for you :)
As mentioned by @Harvester57, App Control is system-wide. Even though AppLocker does support user-based restrictions, there are many ways to bypass it, that's why App Control which is AppLocker's successor, doesn't have that vulnerability.