This message was deleted.

You’ll need a specific allow/deny split and assignment of your rules - you can’t do this within a single rule. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules#rule-exceptions

So one group to Deny and one to Allow? But if I use something like Domain Users for the Deny, then the Deny takes precedence....this isn't very good. FSLogix method so much better. So we have to specifically set an AD group that Denies. Oosh

it's been a while since i had to tackle this, but could you not just have an "allow rule" that allows a specific folder to run executables, but have an exemption in that folder that says "no" (so you would exempt powershell.exe from an allow rule - this is different than a deny).... you would then have another rule which is allowed specifically for the powershell.exe.... from memory (and i could be wrong), it's only when you start having explicit deny rules that things become a nightmare - end of the day AppLocker is designed for whitelist methodology

Ah that makes sense