Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Windows Store App Blocks With Rapid Config Enabled

App Control: Windows Store App Blocks With Rapid Config Enabled

Environment

  • App Control Console: All Supported Versions
  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Symptoms

  • Agent enforcing blocks on software applications installed/updated via the Windows App Store.
  • Rapid Config for Windows App Store is enabled.
  • Paths for non-Microsoft standards are present for Windows Store objects

Cause

The Rapid Config for Windows App Store must be customized to allow for the Approval of software that is not installed in the default path: 
<programfiles>\windowsapps\microsoft.*

Resolution

  1. Login to the Console and navigate to Rules > Software Rules > Rapid Configs
  2. Edit (pencil icon) the Windows App Store.
  3. Add any additional paths that are required.
    Examples:
    \windowsapps\*hpprintercontrol*\*
    \windowsapps\appup.intelgraphicsexperience*\*
  4. Save the changes.
Note: This Rapid Config will instruct the Agent to issue a Local Approval as files are written. If the files are already written then a different Approval Method may be required until those files are updated (written) next.

Additional Notes

As a workaround, files that were already written and now blocked could be issued a Local Approval with the following steps:
  1. Navigate to Assets > Files > Files on Computers
  2. Show Filters > Add Filter > File Path > begins with: Paste/type the path in the text box
  3. Add Filter > Local State > is: Unapproved
  4. Apply
  5. Select one or more of the filtered files
  6. Action > Locally Approve

Related Content


Labels (1)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎11-19-2020
Views:
1027
Contributors