App Control: File Creation Rule for Installing Microsoft Teams

[#1]

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Symptoms

'New unapproved file to computer' Events similar to one below reported when installing Microsoft Teams on a Windows 10 machine:

Computer discovered new file 'c:\users\User1\appdata\local\microsoft\teams\stage\libegl.dll' [a1ab1969d575e26ed1f0c6169b0c2f821c30da3cd253ace254f15765e551a8be]. DiscoveredBy[Kernel:Create]

Cause

Some files used to install Microsoft Team are not being approved by Publisher (Microsoft).

Resolution

1. Login to the Console and navigate to Rules > Software Rules > Custom > Add Custom Rule.
2. Add following values: 
   • Platform: Windows 
   • Rule Type: File Creation Rule 
   • Write Action: Approve 
   • Path or File:

     <LocalAppData>\microsoft\teams\*\resources\app.asar.unpacked\node_modules\*.node 
     <LocalAppData>\microsoft\teams\*\resources\app.asar.unpacked\node_modules\*.dll 
     <LocalAppData>\microsoft\teams\stage\*.dll 
     <LocalAppData>\microsoft\teams\current\*.dll
     

   • Process:

     <LocalAppData>\microsoft\teams\update.exe
     <LocalAppData>\squirreltemp\update.exe

   • Apply to the desired 'Policies'
   • Click 'Enabled'
3. Save the new Custom Rule.