nsacyber / applocker-guidance Goto Github PK

When importing the AppLocker Popup Alert Task into Windows 2019 Task Scheduler the task as designed doesn't work because the Action type of "Display a message" has been deprecated. You can do the following instead now to provide popup information.

Action = Start a program
Program/script = msg
Add arguments = * Message to pop up

The * and a space before the message is important so that it sends to all interactive users otherwise you have to know the user to send to. I used the exact syntax from the previous popup and it works as expected here too.

Can we change the antiquated terms "whitelist" and "blacklist" to something that implies making a correct decision?

• Safelist/blocklist
• Allow/deny rules
• etc.

This would be consistent with the vendor's documentation.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview

The current STIGs for AppLocker sent me to https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm. That site doesn't exist, so it redirected me to https://apps.nsa.gov/iaarchive. I searched for the Application Whitelisting Using Microsoft AppLocker document and found it. It told me to download Applocker Starter Policy.xml from https://gethub.com/iadgov, which said it isn't in use any longer and to try https://github.com/nsacyber. I'm finally here, but there doesn't seem to be a policy for all systems; just Windows 10. Are there any others, or can I use the Windows 10 policy for our Windows servers, as well? And does anyone know how to get the links in STIGs fixed? This has been a wild goose chase.