Skip to main content

Exploit breaks Windows out of the AppLocker, to the dismay of IT admins everywhere

One of the big selling points of Microsoft’s Windows 10 Enterprise is that an administrator can lock down software, restricting users to only installing certain, approved, apps. That means that admins don’t really need to worry as much about malware. However, security researcher Casey Smith has found a method for circumventing Microsoft’s AppLocker support.

AppLocker traditionally works by giving system administrators the ability to customize what software a user is and isn’t allowed to install – essentially white-listing and black-listing various applications. However what Smith has discovered is a way to get around that entirely.

Recommended Videos

The exploit involves using the regsvr32 command-line utility, to point to a remotely hosted file instead. It essentially lets users install or run any application you want, essentially bypassing the entire AppLocker protection system.

Related: Don’t want anything to do with Windows 10? Here’s how to banish it for good

No registry changes are involved and as CSOOnline points out, the lack of administrative privileges needed to make this work, means that someone at a company could use this loophole without anyone knowing, essentially giving them free reign on an internal network. That’s particularly dangerous for some organisations.

Microsoft has yet to comment or release an official patch for the bug, but sage advice suggests using Windows Firewall to block regsvr32 from running, thereby making it so that the file that makes all this possible isn’t accessible. There may be a workaround for that, but for system administrators worried that workers will find news of this bug and begin exploiting it, it might not be a bad idea to put that stopgap solution in place.

If you’d prefer a ready made solution, there is some suggestion that the Windows built-in Device Guard, when fully enabled with script protection, does prevent this exploit from being used, though how permanent a solution that is remains to be seen.

Jon Martindale
Jon Martindale is a freelance evergreen writer and occasional section coordinator, covering how to guides, best-of lists, and…
The insane Samsung Odyssey Ark gaming monitor is $900 off today
A person playing a video game on the Samsung Odyssey Ark 2nd Gen Gaming Monitor.

For a gaming monitor that's going to supercharge your gaming setup, you should check out the 55-inch Samsung Odyssey Ark 2nd Gen. This amazing screen is originally priced at $3,100, but you can currently get it with a $900 discount from Samsung itself. Its lowered price of $2,200 is still pretty expensive, but it's going to be worth every single penny. You're going to have to be quick with your purchase though, as with all monitor deals with high demand, the savings may disappear sooner than you expect.

Why you should buy the 55-inch Samsung Odyssey Ark 2nd Gen curved gaming monitor

Read more
SpaceX Starlink rivalry grows as next Kuiper deployment nears
A ULA rocket launching Amazon's first Project Kuiper satellites in April 2025.

Amazon is about to send another batch of Project Kuiper internet satellites to orbit as it seeks to take on SpaceX’s Starlink service to provide broadband internet to customers around the world.

The tech giant has a long way to go before it has any hope of effectively challenging Starlink, but with its second launch set for next week, progress is being made toward its goal.

Read more
Buy a Samsung G6 or G9 gaming monitor and get a free JBL gaming headset
Kena Bridge of Spirits on the Samsung Odyssey OLED G9.

If your gaming PC setup needs a screen upgrade, we highly recommend taking a look at Samsung monitor deals. There are always some huge savings available for the brand's gaming monitors, and we've picked out two of them for you to consider. The 27-inch Samsung Odyssey OLED G6 gaming monitor is on sale for $700 following a $200 discount on its original price of $900, while the 49-inch Samsung Odyssey OLED G9 gaming monitor is down to $1,000 for savings of $800 on its sticker price of $1,800.

No matter which of these two displays you choose, you'll get the JBL Quantum One gaming headset -- featuring active noise cancellation, head-tracking 3D audio, epic audio quality, and an ergonomic design with a regular price of $200 -- for absolutely free. You're going to have to hurry with your purchase though, as there's no telling how much time is remaining until the price cuts and the offer for the free gaming headset expire.

Read more