This message was deleted.
# _generals
Slackbot
02/02/2023, 5:30 PMThis message was deleted.
r
Ryan Gallier
02/02/2023, 6:51 PMMultiple ways. You can match on .exe name, you can match on hash of the file, etc etc. Symlink shouldn't really matter?
d
Dennis Parker
02/02/2023, 7:01 PMRight, it "shouldn't" but it sure seems to.
The issue is that with UPM creating the symlink to a path for profile containers (sorry I didn't include that in the initial question)
We had Publisher rules which broke when the .exe were moved in to the profile container.
I have creating path and hash rules for the path to the files and the alternate paths (\Device\HardDiskVolume#\Profiles\AppData\Local\Worldox )
Dennis Parker
02/02/2023, 7:07 PMWhen trying to use the Test-AppLockerPolicy powershell anything that resides in the UPM container returns
Test-AppLockerPolicy : Unspecified error'*' violates pattern constraint of '([0-9]{1,5}.){3}[0-9]{1,5}'.At line:1 char:1+ Test-AppLockerPolicy -XMLPolicy c:\pti\applock.xml -Path C:\Users\ni ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : NotSpecified: (:) [Test-AppLockerPolicy], DirectoryNotFoundException+ FullyQualifiedErrorId : TestAppLockerPolicyCmdlet-FailedProcessingFile,Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.TestAppLockerPolicyCmdletr
Ryan Gallier
02/02/2023, 7:08 PMah, yeah, that's pretty specific/special. Perhaps @James Rankin has more specific information on your setup.
d
Dennis Parker
02/02/2023, 7:09 PMI thought the same thing. 🙂
Dennis Parker
02/02/2023, 8:02 PMMore information. I assigned a drive letter to the mounted profile container and the Applocker policies started working as expected.
I removed the drive letter. The Applocker policies continued to work.
I logged out and back in several times. The Applocker policies continued working.
I renamed the profile container vhdx to get a new one created for the test user. Applocker polices do not work again. There is something that needs to be tagged in the volume it appears.
Now going to dig up the FSLogix VHDX create script and see what it does that might give me some ideas.
This may also lead to some ideas for other issues with CItrix UPM Profile Containers I have.
Dennis Parker
02/02/2023, 9:29 PMI'm out of the office tomorrow, but will be looking at this on Sunday.
j
James Rankin
02/03/2023, 8:54 AMSo AppLocker doesn't work on a UPM-mounted container unless it has a drive letter assigned at some point?
d
Dennis Parker
02/06/2023, 5:05 PM@James Rankin Yes. That's what I am seeing at this point.
j
James Rankin
02/06/2023, 8:59 PMHmm, let me see if I can recreate
d
Dennis Parker
02/06/2023, 10:27 PMMuch appreciated.
I just put in a workaround using ControlUp trigger to run as system to mount the Profile Container in the user profile as a path. This works for now. I'm working on opening a ticket with Citrix, but trying to avoid frontline support techs in doing so...will see how that goes.
Dennis Parker
02/07/2023, 4:18 PMIf it makes a difference, I am running VDA 2203 CU2.
Dennis Parker
02/19/2023, 5:34 PM@James Rankin Just wondering if you have had any time to recreate this? No big deal if not. I'm trying to work with Citrix on it as well.
j
James Rankin
02/19/2023, 10:57 PMSorry been busy, it is on my board though,,,,will test tomorrow if possible
👍 1
2 Views