The .NET Runtime installer is signed, thankfully, but the Product Name has the version in it, which is firstly redundant because the version is supposed to be in the file version, but also completely breaks application control capabilities because it necessitates either
a) A new rule every time an update is released, an extreme amount of effort to maintain across a large and diverse client base; or
b) Allowing this with path rules, which is a security risk given that the runtime extracts to TEMP, which is user-writable
See the screenshot which is from the AppLocker wizard for convenience of displaying the issue, but applies equally to App Control for Business.
The Product Name should not change based on minor version. It could change for major version (i.e. "MICROSOFT WINDOWS DESKTOP RUNTIME - 8") assuming the release cadence does not accelerate to browser version numbering.
The occurrence of this issue is noticed regardless of tools used to deploy the runtime; in fact we notice this issue when deploying updates to .NET Runtime via Windows Update itself, in environments where application control technologies built into Windows are in use.
The Product Name field only supports wildcards as the entire contents of the field; i.e. it is not possible to have a publisher rule matching "MICROSOFT WINDOWS DESKTOP RUNTIME - 8.*"
The .NET Runtime installer is signed, thankfully, but the Product Name has the version in it, which is firstly redundant because the version is supposed to be in the file version, but also completely breaks application control capabilities because it necessitates either
a) A new rule every time an update is released, an extreme amount of effort to maintain across a large and diverse client base; or
b) Allowing this with path rules, which is a security risk given that the runtime extracts to TEMP, which is user-writable
See the screenshot which is from the AppLocker wizard for convenience of displaying the issue, but applies equally to App Control for Business.
The Product Name should not change based on minor version. It could change for major version (i.e. "MICROSOFT WINDOWS DESKTOP RUNTIME - 8") assuming the release cadence does not accelerate to browser version numbering.
The occurrence of this issue is noticed regardless of tools used to deploy the runtime; in fact we notice this issue when deploying updates to .NET Runtime via Windows Update itself, in environments where application control technologies built into Windows are in use.
The Product Name field only supports wildcards as the entire contents of the field; i.e. it is not possible to have a publisher rule matching "MICROSOFT WINDOWS DESKTOP RUNTIME - 8.*"