AppLocked | How does it work?

Question

AppLocked | How does it work?

Businaro Alessio - Epta 0

Hi everyone, I created a specific rule to block WinRAR given the recent CVE-2025-8088; the rule targeted the WinRAR.exe file, and the system automatically created default rules for the Windows and Program Files folders.
AppLocker WinRAR

I immediately noticed that almost all applications were blocked.
This app il locked by admin Restoring access to applications and the system wasn't easy.

WinRAR Hash

I then tried creating a rule based on the file hash. This didn't block all applications like before, but I can still use WinRAR.

Carolyne 1,151 Reputation points Microsoft Employee

2026-03-31T19:04:14.23+00:00

From what I have seen AppLocker is deny‑by‑default when enforced. If default Allow rules for Program Files and Windows are missing or auto‑generated incorrectly, almost all apps will be blocked.
You might have to temporarily disable AppLocker enforcement (set rules to Audit only or stop the Application Identity service) to immediately restore access, then re‑enable after fixing rules. AppLocker blocks anything not explicitly allowed once enforcement is on. Then recreate rules using Allow rules first (default rules) and then add a targeted Deny rule (publisher or specific path for WinRAR.exe). Hash rules won’t work well here because WinRAR can change binaries. Microsoft recommends default allow rules before deny rules to avoid mass blocking.

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-03-31T19:04:14.23+00:00

From what I have seen AppLocker is deny‑by‑default when enforced. If default Allow rules for Program Files and Windows are missing or auto‑generated incorrectly, almost all apps will be blocked.
You might have to temporarily disable AppLocker enforcement (set rules to Audit only or stop the Application Identity service) to immediately restore access, then re‑enable after fixing rules. AppLocker blocks anything not explicitly allowed once enforcement is on. Then recreate rules using Allow rules first (default rules) and then add a targeted Deny rule (publisher or specific path for WinRAR.exe). Hash rules won’t work well here because WinRAR can change binaries. Microsoft recommends default allow rules before deny rules to avoid mass blocking.