Application in AppData

[krunph]

Hello,

We have some apps that are located in user's AppData folder and i'm not sure if I'm doing it correctly.
Allow New Apps
Step 1 Suppl name -> Base Policy
Step 2 I browsed the folder of the application e.g C:\Users<myuser>\AppData\Local\App
Step 3 Scan Level Publisher

After I created and deployed it, it worked. I check the xml file and I saw that there's my username in the policy and it didn't change from %userprofile% or any wildcard. Is this a normal behaviour? will it work if I deploy it to other machines with different user?

Thanks in advance

[HotCakeX]

Hi,
Yes, it is a normal behavior.

%userprofile% is not a valid macro, only the following macros are supported by the App Control engine in the OS: %OSDRIVE%, %WINDIR%, %SYSTEM32%. The reason is that an App Control policies applies to the entire system, not user accounts, so if there are more than 1 user accounts, %userprofile% wouldn't be solvable. All of them are only used by File path scan levels/rules.

When you use Publisher scan level, if a file or log is unsigned, hash rules are automatically created instead (I can provide more customization options for this area if needed). FilePublisher, Publisher or Hash levels don't rely on file paths, so yes, your policy will work on other machines, but just to be sure, can you please tell me where you exactly see the username in the XML policy? Is it in the FriendlyName field?

[HotCakeX]

what is the file size limit of the policy when deloyed using app control manager? when deployed in intune, the file size limit is 1MB :(

The limit is mentioned in the article i linked above. Currently 350KB but remember when XML is converted into CIP, it gets a lot smaller. Also for signed policies, you have to use CIP, XML can't be used.

[krunph]

Hi @HotCakeX , need your expertise :p
AppData folder whitelisting works only from windows 11? I deployed my policy and it is working to those who have win 11, but win10 are getting block

[HotCakeX]

Yes, not all pattern based file rules work on Windows 10, please check out this section: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#example-filepath-rules-with-wildcards

[krunph]

got it! thanks as always :)

[HotCakeX]

Anytime ^^