Solved Windows Client update blocked by applocker because it's "file hash" signed instead of "Publisher" signed

[Nico.PL]

When client is updated the .exe needs to be manually allowed in the windows applocker policy to be allowed to run. This because it is being signed as file hash instead of as publisher.
Can this be resolved to allow an easier rollout of updates.

Thx.

 

[Alphabetic]

Can you not roll out the updates as administrator?

 

[Nico.PL]

This is on user laptops/desktops where clients can be installed by users itself, client auto requests to update when started and this works. But as client is not correctly signed it is blocked by applocker after update.

 

[Alphabetic]

It still not allow it even if they right click the app > Run as admin?

 

[Alphabetic]

You could try amending your policy to allow the file path instead maybe?

https://docs.microsoft.com/en-us/wi...er/configure-exceptions-for-an-applocker-rule

 

[Nico.PL]

You could try amending your policy to allow the file path instead maybe?

https://docs.microsoft.com/en-us/wi...er/configure-exceptions-for-an-applocker-rule

Thx for the tip, this worked. Running as admin is not an option as end users don't have admin rights

But most secure way is off course correct signing of client. But will check to get this added to the ideas section.