This message was deleted.

Works great unless you run an .EXE from a Citrix UPM profile container.

Thanks Dennis, yeah no UPM in the mix at the moment

App masking is a nicer experience - can’t click what you can’t see

Thanks James, we're most interested with preventing any drive by malware as well as enabling PS Constrained Language Mode

Have implemented it at a couple of customers. Even just configuring and running it in audit mode is useful for the logging on what users may have been running from homedrives or profiles that they shouldn't have been. Lately more customers seem to be going with other managed tools like ThreatLocker to provide much the same functionality but with a nicer GUI.

Love Applocker! Doesn't matter if single or multi session OS

Always applocker but I also use Fslogix appmasking.

Have a look at PolicyPak: https://www.netwrix.com/endpoint_management_software.html

Yeah PolicyPak is an awesome piece of kit