Block Executable

IT admins always handle a lots of software and applications for their IT. With a lot of applications to handle, IT admins will have the need to restrict the usage of certain applications, IT admins can leverage the Block Executable capability of Endpoint Central MSP.

What is Block Executable

Use Block Executable to prevent targeted Windows executables from running on managed computers. Create a Path Rule when the executable name and location are stable, or a Hash Rule when you want to identify a specific executable file.

Choose the feature that matches your goal: use Prohibit Software to uninstall detected software from managed computers, or use Application Control, which is included in the Security Edition and available as an add-on, to create application groups and allowlist or blocklist policies based on vendor, product name, folder path, file hash, or StoreApps. To block an application with Application Control, go to Application Groups, click Create Blocklist, and deploy the group through an Application Control policy. See Configure Application Groups.

Creating and Removing Block Executable Policy

1. To create a Block Executable rule, navigate to Inventory > Block Executable > Add Policy.
2. Add Custom Group(s) to which this rule is to be applied.
3. Next, add the executable that needs to be blocked using either a Path Rule or Hash Rule

To remove a policy, navigate to Inventory > Block Executable, select the policy, and click Remove Policy.

To unblock a specific executable without removing the entire policy, navigate to Inventory > Block Executable, choose Modify for the policy, and open Edit Policy. Select the executable, click Remove, and then click Update.

Block Executable using Path Rule

Use a Path Rule when the targeted executable name and location remain stable. The rule matches the executable file name and extension at the configured path; renaming or relocating the file causes the rule to no longer match. You can create a Path Rule even when the application is not currently present in your network.

Block using Hash Value

Hash is a unique value, that represents the executable. To use this method, IT admins should compute the Hash value for the targeted application and add it to the rule to block that executable. If you want to block an executable that is greater than 200 MB in size, use the below attached code snippet to compute the Hash value. While computing the Hash value, provide the full path of the file location of the software that you want to block using Hash value.

Windows commands

dir <"FILE LOCATION">

certutil -hashfile <"FILE LOCATION"> md5

certutil -hashfile <"FILE LOCATION"> sha256

(Get-AppLockerFileInformation -Path <"FILE LOCATION">).Hash -replace '^SHA256 0x', 'Hash: '

Block Executable for All Computers

Endpoint Central MSP by default has a custom group named "All Computers Group", which contains all the managed computers. If you want to block an executable for all the managed computers, then you can choose the default Custom Group and select the executable, which needs to be blocked.

Block Executable for Specific Computers

To block an executable for a specific target, create a new custom group or use an existing custom group. Custom groups can be unique or static. Apply the policy to the custom group that contains the required computers.

To change which computers receive a group-targeted policy, update the membership of the targeted custom group. Add computers that should receive the policy, and remove a computer from the group to keep it outside the policy scope.

Block executable does not support blocking executable which are initiated by the system.

Troubleshooting Tips

1. How to enable Local Group Policy on the target machine?

   Perform the following actions manually on the target computer:

   1. Go to Run

   2. Type gpedit.msc

   3. Click Group Policy

   4. Click on "Turn Off Local Group Policy Objects Processing" as shown below.

      

   5. Ensure that you have chosen "Not Configured" as shown in the below image.

      

      You have now enabled Local Group Policy on the target machine.

2. How to enable Local Group Policy on the target computer?

   Perform the following actions manually on the target computer:

   1. Go to Run

   2. Type gpedit.msc

   3. Right Click on "Local Computer Policy", Choose Properties to ensure that "Disable Computer Configuration Settings" is not selected.
      
      You have now enabled Local Group Policy on the target computer.

3. How to set the Default security Policy as "Unrestricted"

   Perform the following actions on the target computer:

   1. Go to Run

   2. Type gpedit.msc

   3. Click "Security Levels" and double click "Unrestricted" as shown below
      
   4. Ensure that the status is set as "Default" as mentioned in the image below.

   

   You have now enabled Local Group Policy on the target computer.

4. How to enable Local Group Policy for the Administrator?

   Perform the following actions on the target computer:

   1. Go to Run

   2. Type gpedit.msc

   3. Click "Software Restriction Policy"

   4. Double click "Enforcement" to ensure that "All Users" is selected as shown in the image below

      

      You have now enabled Local Group Policy for Administrators.

5. Why does the message "This app has been blocked by your system administrator" appear?

   When Windows displays this message, first check whether a Block Executable policy that includes the executable targets a custom group containing the computer. If no Block Executable policy applies, identify the enforcing source by reviewing Application Control, Windows AppLocker or Software Restriction Policies, local or domain Group Policy, Microsoft Intune, and the other endpoint-management or security controls used in your organization.