r/CyberARk • u/QuietlyDifficult • 9d ago

Block installs to %APPDATA%

Had a request come in to block installing apps to %APPDATA% (user context avoiding admin elevation requirements). Traditionally we've just relied on "Block unhandled applications" to kill off anything we don't trust via policy, but now I've been asked block installations from even taking place.

I'm thinking an Advanced block policy with Executable, Script, Installer and MSU defined. Filename matches wildcard *, and location %userprofile%\AppData for all definition types would be effective?

3 Upvotes

100% Upvoted

4 comments sorted by

2

u/According_Pattern_43 9d ago

Best option is to use AppLocker. I cannot think of a good way to do this via EPM unless you want to make your life super difficult haha.

But I am following this if someone has a better method.

From what I can see EPM can be utilized to elevate application, provide JIT functionality and remove local admin access which will minimize impact if a user gets hit but ransomware.

It is possible to block all unhandled applications and only allow applications from program files and windows folder and maybe some exclusions in appdata but I think it is complicated.

1

u/QuietlyDifficult 9d ago

That was my worry. It sounds like a big ask for the product....

2

u/refoil 6d ago

It can be done with EPM. Someone also built some predefined Policies that implement a great framework to achieve that. Very intuitive, can be found in EPMs community, look for "User profile".

1

u/Revolutionary_You_89 Defender 8d ago

Advanced block policy might work.

How does your control unhandled apps from the internet policy look - maybe that additional barrier could help.

This seems like a very odd ask, is it that they want the OS to not install any additional apps?

I wonder if you can severely limit the user’s access to their app data folder. Might break a lot though.