Creating rules and deploying policy in Endpoint Application Control (EAC)

Here are some considerations for creating a rule and deploying a policy:

1. Identify the type of application to inspect and group the applications to Allow and Block.

   Block Rules should have a larger scope than the Allow Rules.
   Below are some sample rules when inspecting the Web Browser Add-ons:

   Block Rule:
   Block All Web Browser Toolbars and Plugins

   Allow Rules:
   Allow Adobe Flash Player
   Allow Java Runtime Environment
   Allow Microsoft Silverlight

    

   It is advisable to create one (1) rule per allowed application to easily reuse it on other policies that might require that specific rule.
2. Group the target clients and identify the applications that they can only install.

   For example, both Windows Servers and Workstations can install the Adobe Flash Player and Microsoft Silverlight, but only Windows Servers can install the Java Runtime Environment at the same time. However, if the logon user is Server Admin, there should be no restrictions.
   The group can be similar to the following:

   Allowed Applications on Workstations: Adobe Flash Player and Microsoft Silverlight

   Allowed Applications on Servers: Adobe Flash Player, Microsoft Silverlight, and Java Runtime Environment

   Allowed Applications on Windows w/ Server Admin: Adobe Flash Player, Microsoft Silverlight, and Java Runtime Environment

3. Create a policy based on the predefined applications in the rule and the targets.
   1. Use the Filter Criteria to appoint Target Clients and Logon User(s).
   2. Create the ruleset via Rules tab.
   3. Make sure that the names of the policies denote the target applications and clients.

   From our previous samples, you can create three (3) possible policies similar to the following:

   • Allowed Web Browser Plugins on Windows Servers

     Filter Criteria: Windows 2000/2003/2008/2012

     Rules:
     Allow Adobe Flash Player
     Allow Java Runtime Environment
     Allow Microsoft Silverlight
     Block All Web Browser Toolbars and Plugins

   • Allowed Web Browser Plugins on Windows Workstations

     Filter Criteria: Windows XP/Vista/7/8

     Rules:
     Allow Adobe Flash Player
     Allow Microsoft Silverlight
     Block All Web Browser Toolbars and Plugins

   • Allowed Web Browser Plugins w/ user Server Admin

     Filter Criteria: Server Admin, Windows XP/Vista/7/8/2000/2003/2008/2012

     Rules:
     Allow Adobe Flash Player
     Allow Java Runtime Environment
     Allow Microsoft Silverlight
     Block All Web Browser Toolbars and Plugins

   The ruleset or rules always contain the Block Rule below the Allowed Rules because the rules are processed by the following order to ensure that applications with no matching Allowed Rules are blocked.

   Allowed > Blocked > Lockdown Mode

   The Lockdown Mode prevents installing new applications on a client but the existing applications will still run. In addition, Windows System Applications, including Windows Updates, are allowed by default.

4. Arrange the policies by priority.

   A policy with a more specific criteria should have a higher priority. On the other hand, a policy with a wider range of targets should have lower priority.

   In this case, the "Allowed Web Browser Plugins w/ user Server Admin" is more specific among the other policies because of the user Server Admin and should be assigned the first priority. The policies can be ordered like this:

   • Priority 1: Allowed Web Browser Plugins w/ user Server Admin
   • Priority 2: Allowed Web Browser Plugins on Windows Workstations
   • Priority 3: Allowed Web Browser Plugins on Windows Servers

   When you have a Deny Policy, make sure that you assigned it as lowest priority. Policies are processed in a downward direction so that the permitted applications are identified first before it fall under Blocked Policies.