The AppLocker bypass exploits to be fixed with the next major Windows version

2 min. read

Updated onOctober 4, 2023

updated onOctober 4, 2023

Share this article

Improve this guide

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

AppLocker is a feature in the Windows OS and Windows Servers allowing admins to control which users can run particular apps. The tool uses unique identities of files, and lets admins create rules to allow or block applications.

AppLockerallows administrators to control the following app types: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.msi and .msp), and DLL files (.dll and .ocx).

Although AppLocker’s role is to filter users’ access to apps and enhance system security, the tool also comes with its own exploits. Recent reports have revealed that unprivileged users can bypass AppLocker and other Software Restriction Policies on all Windows versions, fromWindows XPtoWindows 10.

More specifically, the LOAD_IGNORE_CODE_AUTHZ_LEVEL 0x00000010 value, and other values allow unprivileged users to bypass the AppLocker rules, as well as the Software Restriction Policies for the DLL. It is worth mentioning that this action applies only to the DLL being loaded, and not to its dependencies.

However, Microsoft doesn’t consider that this exploit needs to be fixed as soon as possible. The company has acknowledged the issue and confirmed that this exploit will be patched in a future version of Windows.

The product team has finished their investigation and determined this will be serviced in a future version of Windows. AppLocker bypasses are not serviced via monthly security roll-ups; only major version updates.

KB2532445but serviced a bypass with a hotfix which was incorporated in later security updates and is included in the“convenience”rollup.

If you want this fixed immediately and are an enterprise customer you’ll need to work with your Account Manager to open a support case.

As far as the release date of the next major Windows version is concerned, recent reports suggest that Microsoft could roll it outat the end of March. In the worst case scenario, the update should arrive mid-April.

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low#

Copilot in Outlook will generate personalized themes for you to customize the app#

Microsoft will raise the price of its 365 Suite to include AI capabilities#

Death Stranding Director’s Cut is now Xbox X|S at a huge discount#

Outlook will let users create custom account icons so they can tell their accounts apart easier#

The AppLocker bypass exploits to be fixed with the next major Windows version#

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low

Copilot in Outlook will generate personalized themes for you to customize the app

Microsoft will raise the price of its 365 Suite to include AI capabilities

Death Stranding Director’s Cut is now Xbox X|S at a huge discount

Outlook will let users create custom account icons so they can tell their accounts apart easier

The AppLocker bypass exploits to be fixed with the next major Windows version