Windows AppLocker deny policy blocks execution of unrelated FRP-encrypted EXEs

Technical Articles ID: KB96883
Last Modified: 2023-12-01 06:36:24 Etc/GMT

Environment

File and Removable Media Protection (FRP) 5.1.0 and later

Windows 10 and later

For FRP-supported environments, see KB81149 - Supported platforms for File and Removable Media Protection.

Problem

When an AppLocker deny path policy is set for an executable on an FRP Windows client, an attempt to run any unrelated FRP-encrypted executable fails with the following error:

This program is blocked by group policy. For more information, contact your system administrator.

Cause

While the root cause isn't yet known, tests reveal that FRP's virtual namespace architecture isn't compatible with AppLocker.

Solution

A permanent solution isn't yet available.

NOTE: See the "Workaround" sections to use a suitable workaround.

Workaround 1

If executable encryption isn't critical, add File Extension Exclusion in Encryption Options policies to exclude .exe from getting encrypted in the future.

Workaround 2

To run an executable that's already encrypted by FRP, decrypt it before attempting to run it.

Use either for the following:

Explicit decrypt from Windows File Explorer context menu for FRP (Controlled by General Policy)
Copy the file to an intermediate decrypted folder (Explicit General Policy or Location-Based Policy)

Knowledge Center

Windows AppLocker deny policy blocks execution of unrelated FRP-encrypted EXEs

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Title

Title

Knowledge Center

Windows AppLocker deny policy blocks execution of unrelated FRP-encrypted EXEs

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Choose your region

Title

Title