Is there any legal substitute for AppLocker in Windows 7 Professional?
We are planning a rollout to Windows 7 but at the moment management are umming and ahhring about Windows 7 Pro vs Enterprise and Pro is winning.I would like to utilise AppLocker policies as they can be used to get around licencing issues where the software
is installed on the machine but locked so users are unable to use it. I was wondering if there is anything like this on Pro? I realise I could use a GPO to disable software from running but I would imagine this is unlikely to be acceptable as AppLocker from
a licencing point of view. Can anyone confirm this and let me know if there is anything else that can be done (short of not installing /uninstalling the software).
Thanks
Simon
December 10th, 2011 9:18am
http://technet.microsoft.com/en-us/library/dd548340(WS.10).aspx
AppLocker is a new technology available in Windows 7 Enterprise and Windows 7 Ultimate. In addition, AppLocker is available in Windows Server 2008 R2 Standard, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2
Datacenter, and Windows Server 2008 R2 for Itanium-Based Systems. Software Restriction Policies is also available in these same editions.
Free Windows Admin Tool Kit Click here and download it now
December 10th, 2011 11:28am
Yes I know...but my question is whether anything can be done to prevent software being run on a Windows 7 Pro machine that would be acceptable from a Microsoft licencing perspective.
December 10th, 2011 12:11pm
http://technet.microsoft.com/en-us/library/ee619725(WS.10).aspx#BKBK_WhichOSeditions
Which editions of Windows can I use to create AppLocker rules?
To create rules for a local computer, the computer must be running Windows 7 Ultimate or Windows 7 Enterprise. If you want to create rules for a Group Policy object (GPO), you can use a computer that is running any edition of Windows 7, provided
that the Remote Server Administration Tools are installed.
AppLocker rules can be created on any edition of Windows Server 2008 R2.
While you can create AppLocker rules on computers running Windows 7 Professional, they will not be enforced on those computers. However, you can create the rules on a computer running Windows 7 Professional and then export the policy for
implementation on computer running an edition of Windows that does support AppLocker rule enforcement.
Free Windows Admin Tool Kit Click here and download it now
December 10th, 2011 12:26pm
Yes, yes, yes. I know about Applocker. But it won't work on Professional. What's the alternative if any?
December 10th, 2011 1:28pm
software restriction policy should work
Computer Configuration\Windows Settings\Security Settings\Software Restriction Policies
According to this web site that should work, i don't have win 7 pro to test it myself, but it should work, because it works on windows xp pro as well.
http://helpdeskgeek.com/windows-7/difference-between-windows-7-home-professional-and-ultimate/
In addition to the points mentioned above, Professional also has the following features and services:
Support for Dynamic Disks. This allows
software
implementation of RAID, which could be useful for a system with multiple hard drives.
Encrypting File System – Allows for filesystem-level encryption. Not as secure as BitLocker, which is only available in Ultimate.
Location Aware Printing Presentation Mode – Lets you change the behavior of Windows while giving presentations, i.e. control volume, display different wallpaper, prevent screensaver from appearing, etc.
Group Policy – Allows you to control just about all aspects of
the
Windows operating system locally or via Windows Server
2003/2008 Offline Files and Folder Redirection – Again, more a feature of a Windows machine joined to a domain
Ability to join a Windows
domain
– Home Premium cannot join Windows domains Windows XP Mode – Allows you to run Windows XP SP3 inside Windows 7. Used for compatibility with older programs.
Software Restriction Policies
Free Windows Admin Tool Kit Click here and download it now
December 10th, 2011 2:30pm
Hi,
Currently, AppLocker only works on Windows 7 Enterprise and Ultimate. It seems there is not an absolute alternative in Windows 7 Professional.
You could get a more information about the difference between them:
AppLocker: Frequently Asked QuestionsAlex Zhao
TechNet Community Support
December 13th, 2011 4:50am
Hi,
Currently, AppLocker only works on Windows 7 Enterprise and Ultimate. It seems there is not an absolute alternative in Windows 7 Professional.
You could get a more information about the difference between them:
AppLocker: Frequently Asked QuestionsAlex Zhao
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
December 13th, 2011 8:41pm
Hi,
Considering the goal we want to achieve, the software restrictive policies would be a better alternative.
Alex Zhao
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
tnmff@microsoft.com.Alex Zhao
TechNet Community Support
December 13th, 2011 8:43pm
But from a legal, MS Licencing perspective, are software restriction policies adequate? Yes, they will stop you running a program or application in the 'conventional' manner but these won't stop you running that same piece of software via a system account
or in a different environment, eg console.
Free Windows Admin Tool Kit Click here and download it now
December 14th, 2011 5:11am
Hi,
Since this problem is clear for us. I would mark the previous reply as “answer”. If
you have any further questions or concerns? Please feel free to let us know.
Regards,
Alex Zhao
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
tnmff@microsoft.com.Alex Zhao
TechNet Community Support
December 16th, 2011 7:55pm
Well since you ask...
I still haven't had a definitive 'yes' or 'no' as to whether software restriction policies constitute a legal alternative to removing the software like Applocker is.
Free Windows Admin Tool Kit Click here and download it now
December 17th, 2011 4:58am
Hi,
AppLocker is not only a replacement of Software Restriction Policy, it also contains some new capabilities and extensions.
From your description, your request would be a new feature:
What's New in AppLocker in Windows Server 2008 R2 and Windows 7
Alex Zhao
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
tnmff@microsoft.com.
Alex Zhao
TechNet Community Support
December 20th, 2011 9:48pm
I know it contains new capabilities, I have used it. I simply would like to know whether locking an app via a SRP is acceptable by Microsoft as a means of preventing a licence being used up.
Free Windows Admin Tool Kit Click here and download it now
December 21st, 2011 4:55am
Hi,
No, I don't think SRP is good enough you should ever consider using it. Of course, you can refer more information through Technet:
http://technet.microsoft.com/en-us/library/bb457006.aspx#EIAA
Thanks, BrianPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
December 23rd, 2011 2:39am
Have just found this:
http://technet.microsoft.com/en-us/library/bb457006.aspx
Halfway down it gives an example of a scenario where you might want to use a software restriction policy:
Example
A computer lab at a university runs 15 machines with identical software. They have Microsoft Office, computer-aided design (CAD) software, and the Microsoft Visual C++® compiler. For licensing reasons, the administrators of the computer lab want
to ensure the following:
Any student can use Microsoft Office—all students are members of the AllStudents group.
Any engineering student can use the CAD software—engineering students are members of the EngStudents group.
Any computer science student can use the Microsoft Visual C++ compiler—computer science students are members of the CSStudents group.
From this it would appear that it is indeed legal to use Software Restriction Policies for licencing purposes.
Free Windows Admin Tool Kit Click here and download it now
January 11th, 2012 5:25pm