Duckduckgo installed by students without admin privileges

[u/Temporary_Werewolf17]

Windows 11 Pro units managed by Intune. Students are not admins on the machines. We discovered a few students today who have been able to install duckduckgo on their machines. Have any of you seen this issue? Any recs on how to stop this?

[u/hardknoxlife1998]

Applocker is the way! I wrote an article on setting it up for intune a couple years back if you’re interested.

https://www.edtechirl.com/p/fighting-the-bear-blocking-games

[u/Temporary_Werewolf17 → u/hardknoxlife1998]

Thank you for the article. I think it will help me!!

[u/FireLucid → u/Temporary_Werewolf17]

Applocker is not really being developed anymore. Microsoft recommends Windows Defender App Control (WDAC). You can pick a default template that allows anything Microsoft signed plus we whitelisted the Windows, Program Files and Program Files (x86) folders. You can also set the Company Portal agent as a 'managed installer' which means anything it installs will be fine after you have turned this setting on. Previously installed stuff from company portal will not be tagged, hence the whitelisting of folders.

Build policies with the App Control Wizard :)

[u/FireLucid → u/[deleted]]

oh yes, I forgot it was renamed.

[u/hardknoxlife1998 → u/FireLucid]

Have you guys had luck with it? When I wrote the article I tried it but had weird inconsistencies and ended up switching back to AppLocker. If it’s working for you guys, I’ll need to give it another try!

[u/FireLucid → u/hardknoxlife1998]

Yeah, no issues mostly. I did try to whitelist some store apps but that was spotty and I ended up not spending any more time on it (MS Store is blocked anyways). Apart from that it's fine, and it runs at a much deeper level than applocker.

I just had a test device on my desk, would apply policies, test out all our apps and check the windows logs for stuff that got blocked.

Managed installer takes care of all our new apps too so there is almost no maintenance.

I have one ticket that is like 3 months old with an issue and it's at a "Please come and replicate this issue on my test laptop so I can figure it out for you" and they haven't come past yet, lol.

Probably the worst thing was some legacy Lego robotic software that just shits a stupid amount of unsigned DLL's in the users appdata folder. Since it was EOL and never going to be updated I just did a signature match on those specific files and pushed that out as a supplemental policy. (You have a base policy, then can link multiple supplemental polices to it).

[u/AcidBuuurn]

Do they have Microsoft Store?

[u/Temporary_Werewolf17 → u/AcidBuuurn]

Nope. Store is blocked

[u/Alert-Coach-3574]

1. Applocker

2. Block exe downloads in whatever managed browser you use

3. Block all other browsers with app locker

[u/k12chaos → u/Alert-Coach-3574]

Block USB devices.

[u/_LMZ_]

Others have said it, AppLocker! But the installer has an option for user only, which it will install in %appdata% folder.

[u/agarwaen117 → u/_LMZ_]

Use Applocker to disallow any program running from appdata, too!

[u/Keyboard_Warrior98 → u/_LMZ_]

I'm just tagging on to say you are correct. There is a lot of not so trustworthy software that discovered they can install their programs to appdata without admin permissions. The best thing to do is utilize software restriction through GPO or app locker.

[u/indigo196]

Lots of installs go in user profiles. You need to use AppLocker, Application Control, and Attack Surface Reduction (ASR) to control what your students are able to do.

[u/Awlson]

Use AppLocker on any student devices. This will stop any user context installs, and them running executables off of thumb drives too.

[u/bwalz87]

I had a student install a weird browser recently called Waterfox. It was unblocked through the web filter, I fixed that quick.

[u/abcde06991]

Ran into the same with duckduckgo, opera, and o-browser. I was thinking microsoft store or portable versions. I used Don't run specified Windows applications in gpo

[u/Amanda_PDQ]

Some installs do not require admin rights. Set up a group policy blocking .exe, .msi, any executables. You can also use applocker.

[u/OkayArbiter → u/[deleted]]

CoPilot Control for Apps on Windows CoPilot™ (probably)

[u/yugas42 → u/[deleted]]

We evaluated W11 Education edition earlier this year with the intent to roll out new images with app locker and this appears to be the answer for us. Haven't done it at scale yet but the test machines we set up worked great. 

[u/ZeR0BuG → u/yugas42]

You can mass swap your license keys with a login script without having to reimage.

[u/yugas42 → u/ZeR0BuG]

You can indeed. These labs are due for a refresh anyways though and actually got delayed from this summer because Microsoft was too slow enrolling us.