Alternative to "Anti-Executable"

[PTNL]

For those that are familiar with Faronic's product called "Anti-Executable".... I'm looking for other similar options/products that prevents unauthorized executables from running on a Windows machine. Whatever product it is, it must be Windows 7 compatible.

Any suggestions?

 

[nessus]

Applocker in Windows 7 group policy?

http://technet.microsoft.com/en-us/library/dd548340(WS.10).aspx

Run only allowed executables group policy in earlier versions (although this only blocks using explorer to launch applications):

http://support.microsoft.com/kb/324036

 

[PTNL]

AppLocker looked very intriguing, but.... The rules will only be enforced on Win7 Ultimate or Enterprise (I should've specified we're using Win7 Professional). This is from Windows 7 within the AppLocker node on "Which editions of Windows support AppLocker?":

AppLocker is available in all editions of Windows Server 2008 R2 and in Windows 7 Ultimate and Windows 7 Enterprise. Windows 7 Professional can be used to create AppLocker rules. However, AppLocker rules cannot be enforced on computers running Windows 7 Professional.

The normal software restriction policy method would not be a good fit for our needs.

 

[mas]

this is exactly what I've been looking for too, something like tiny software/faronic that manages this kind of thing through fully configurable checksum whitelist/shadow copies. problem with applocker is it seems they only have control of signed apps, so what about code that doesn't get cert through ms? your only other option is to deny them all, or allow by name (not sure how that works), so how can we have version control over other software that would be done through some kind of checksum repository.

out of the box we have uac, but afaik this is a simple/dumb allow/deny gate without policies. comodo firewall has a win7 version that does something like this, but I can't stand their ui/bloat. this is really the only thing keeping me on xp.

 

[PTNL]

problem with applocker is it seems they only have control of signed apps, so what about code that doesn't get cert through ms? your only other option is to deny them all, or allow by name (not sure how that works), so how can we have version control over other software that would be done through some kind of checksum repository.

AppLocker is a lot more intuitive than just that. Hopefully this short TechNet video clarifies some of your confusion; whether it still meets your needs is another concept

FWIW, Anti-Executable does its job very well, and I'd still consider it an option in other scenarios; it just doesn't meet some specific needs for my project's requirements.

Edit: In addition to the Anti-Executable product, Faronics also has a good program called Deep Freeze that is conceptually a more feature-rich version of MS's (deprecated) Steady State product.