Creating a Windows application filter profile

We create a Windows application filter profile that prevents the user from running Powershell, MS Paint, and other executables except in the directories %PROGRAMFILES%\*, %WINDIR\*.

To create the Windows application filter:

1. Go to Secret Settings > Windows App Filter Profiles and select +Create.
2. Enter the name for the Windows application filter.
3. In Executable:
   1. Select +.
   2. In Deny, enter C:\Windows\System32\WindowsPowerShell.exe.
   3. Select +.
   4. In Deny, enter %WINDIR%\system32\mspaint.exe.

      

4. Go to the Script tab:
   1. Select +.
   2. In Deny, enter C:\Users\%USER%\Desktop\* to block any script located on the desktop.

      

5. Go to the Installer tab:
   1. In Deny (Recommend), all installers are blocked except those in the directories %PROGRAMFILES%\*, %WINDIR%\*.

      

6. Go to the Advanced Setting tab.
   1. In Refresh Period, keep the default value, 30 minutes.

      

7. Click Submit.

The above target can be created in the CLI using the following commands CLI:

 config secret winappfilter-profile
  edit "Block Paint"
   config rules	
    edit 1
     set deny "*"
     set exception
"%PROGRAMFILES%\\* %WINDIR%\\*"
    next
	edit 3
	 set type script
	 set deny "C:\\Users\\%USER%\\Desktop\\*"
	next
	edit 4
	 set type msi
	 set "*"
	 set exception
"%PROGRAMFILES%\\* %WINDIR%\\*"
	next
	edit 5
	 set deny"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
	next
	edit 6
	 set deny
"%WINDIR%\\system32\\mspaint.exe"
    next
   end
  next
 end