Updating appLocker rules

Question

Updating appLocker rules

Malzaar 0

Why does updating a core enterprise app suddenly break execution for non‑admin users when the publisher’s digital signature version goes beyond the range defined in the AppLocker rule ? And how can we update AppLocker publisher rules using wildcards or broader version ranges ??

0 comments

2 answers

Your answer

Answer 1

Hello Malzaar,

Thank you for posting question on Microsoft Windows Forum!

Well! The plausible explanation to the reason of why AppLocker breaks execution for non-admins after an update is that when you originally created the Publisher rule using an installed file as a reference, AppLocker extracted the digital signature's metadata: Publisher Name, Product Name, File Name, and Binary Version. If the version slider in the rule creation wizard was left at "Exactly" or bound to a specific upper limit, the newly updated app (which has a higher version number) suddenly fails to meet the rule's criteria. Because it no longer matches the explicit "Allow" rule, it falls through to the default block.

On the other hand, for standard users, AppLocker blocks any executable that does not explicitly match an "Allow" rule. At the same time, the reason it still works for local administrators is that nearly all AppLocker deployments utilize the "Default Rules." One of those default rules explicitly permits the built-in Administrators group to run all files, effectively bypassing the strict publisher conditions that standard users are subject to.

Therefore, to fix this and prevent future updates from breaking the app, you might need to broaden the version scope to either "And above" or use an Asterisk (*) wildcard for any version. For more information https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-the-publisher-rule-condition-in-applocker

You can also consult the following articles for more information.

Hope the above information is helpful!

Answer 2

AppLocker publisher rules can break after an app update when the rule is too restrictive for the new file version. A publisher rule identifies a file by its digital signature plus attributes such as publisher, product name, file name, and file version. If the rule was created for a specific version or a bounded version range, and the updated app’s signed version is outside that range, non-admin users are blocked because no matching allow rule exists. A deny rule would also continue to block it and cannot be overridden.

Publisher rules are usually preferred because they are more resilient to app updates than hash rules and more secure than path rules. But they still need review when:

The rule specifies an exact version.
The new version is higher than the allowed range.
The file name changes.
New files are added.
The digital signature changes.

To update the rule, use a broader publisher condition:

Open the existing AppLocker publisher rule in the policy management tool or recreate it from a reference file.
Keep the Publisher value fixed to the signed publisher.
Broaden Product name, File name, or Version as needed.
For File version, choose one of these options:
- Exactly: only that version
- And above: that version and all later versions
- And below: that version and all earlier versions
If the goal is to allow future updates, use And above or use * for a version-independent rule.

Wildcard behavior matters:

Publisher: * by itself means any publisher. If combined with other characters, it is treated as a literal string, not a wildcard.
Product name: * by itself means any product name. If combined with other characters, it is treated as a literal string, not a wildcard.
File name: * or ? by themselves mean any file name. When combined with other characters, the string is matched against file names containing that string.
File version: * by itself means any file version.

A practical approach for enterprise apps is:

Use a publisher rule whenever the files are digitally signed.
Avoid locking the rule to a single version unless there is a strict requirement.
Prefer And above for controlled upgrade paths, or * for version-independent matching when appropriate.
After each app update, verify whether file names, added binaries, or the signature changed.
If an app is unexpectedly blocked, use Test-AppLockerPolicy to determine which rule is preventing execution.
Test changes in audit-only mode before enforcing them broadly.

This is why execution often fails only for standard users after an update: AppLocker is enforcing the allow list, and the updated signed file no longer matches the older publisher rule definition.