This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 87%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Hoping that someone may be able to help me with an issue.
We have applocker policy in place to allow specific apps to run in our environment. One of the users advised that he needed Visual Studio 2019 to be installed on his workstation which I did. I have also grabbed all applocker information from the root folder of the app to avoid any issues with running it. However, we found out that each time he compiled in Visual Studio, a new set of temp batch files would be created and then deleted thereafter. Since the files aren't listed in the XML files, it would fail to run. Does anyone have an idea how to approach this without compromising security?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@Cram, Thanks for posting in Q&A. On my point view, to approach this without compromising security, here is my suggestion:
1, Please check if the temp file location of Visual Studio 2019 can be changed via modify environment variable.
2, If yes, create a new location to put these temp files.
3, Allow the files in this location in AppLocker rule.
Hope the above information can help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi Crystal,
Thanks for responding. It may be possible to redirect the batch files onto a different location. Although every compile done in Visual Studio seems to generate a different batch file. Correct me if I'm wrong but wouldn't that mean that the applocker XML would need to get updated every time a new batch file gets generated which would make management of it a nightmare.
Hi Crystal,
Thanks for getting back to me. It might be possible to redirect the location or the batch file folder. Although as mentioned above, every time the user compiles in Visual Studio, a new set of batch file gets created. Correct me if I'm wrong but wouldn't that mean even with the path change, this would still require manual update of the applocker XML file for each instance?
@Cram, Try to use path rule to include all the temp files in this folder.
@Cram, Hope things are going well. If there's anything else we can help, feel free to let us know.
Hi Crystal,
Can you please advise what would happens after adding all the temp files in the folder and a new set of batch files gets created in the same location. Would that mean we would need to re-add the files after?
@Cram,, You can use the asterisk (*) as a wildcard character within path rules to match all files in this location to avoid readding.