This AppLocker rules blocks everyone from using Internet Explorer. This setting is configured by using an XML blob that is store in the registry setting for this setting. You can obtain the XML blob by configuring the desired setting in the Local Group Policy console and then retrieving the blob from the registry setting. Vulnerability: A malicious agent could run malware by using Internet Explorer. Counter Measure: Disable the use of Internet Explorer on domain controllers for everyone. Potential Impact: Depending on configuration, users will be unable to use Internet Explorer. Fix: (1) GPO: Computer ConfigurationWindows SettingsSecurity SettingsApplication Control PoliciesAppLockerExecutable RulesAppLocker: Executable Rules: Block Internet Explorer (Deny Everyone) (2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsSrpV2Exe881d54fe-3848-4d6a-95fd-42d48ebe60b8!Value

[enable/disable]

(1) GPO: Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Executable Rules\AppLocker: Executable Rules: Block Internet Explorer (Deny Everyone) (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe\881d54fe-3848-4d6a-95fd-42d48ebe60b8!Value