Description
Issue Type: Bug
I am seeing an update for Visual Studio Code. In our environment, we have whitelisted the following:
Publisher: O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
Product Name: VISUAL STUDIO CODE
File name and File Version: *
However, when an update attempts to install, it appears to run a .tmp file as an EXE. However, this file has no product name associated with it and hence cannot run. Note that not all Microsoft signed products are allowed in this environment since there are some products we don't want users to be able to run/execute. Can we get these update files to also include a Product Name in the signature, ideally "VISUAL STUDIO CODE", or something static that doesn't change that we can whitelist?
Here is the error produced when attempting to run this update (I have removed the personal information):
Log Name: Microsoft-Windows-AppLocker/EXE and DLL
Source: Microsoft-Windows-AppLocker
Event ID: 8004
Task Category: None
Level: Error
Keywords:
Description:
%OSDRIVE%\USERS\USERNAME\APPDATA\LOCAL\TEMP\IS-PUPV1.TMP\CODESETUP-STABLE-51B0B28134D51361CF996D2F0A1C698247AEABD8.TMP was prevented from running.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-AppLocker" Guid="{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}" />
<EventID>8004</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<EventRecordID>20593012</EventRecordID>
<Correlation />
<Execution ProcessID="22100" ThreadID="23936" />
<Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel>
</System>
<UserData>
<RuleAndFileData xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
<PolicyNameLength>3</PolicyNameLength>
<PolicyName>EXE</PolicyName>
<RuleId>{00000000-0000-0000-0000-000000000000}</RuleId>
<RuleNameLength>1</RuleNameLength>
<RuleName>-</RuleName>
<RuleSddlLength>1</RuleSddlLength>
<RuleSddl>-</RuleSddl>
<TargetProcessId>21196</TargetProcessId>
<FilePathLength>116</FilePathLength>
<FilePath>%OSDRIVE%\USERS\USERNAME\APPDATA\LOCAL\TEMP\IS-PUPV1.TMP\CODESETUP-STABLE-51B0B28134D51361CF996D2F0A1C698247AEABD8.TMP</FilePath>
<FileHashLength>32</FileHashLength>
<FileHash>5EF92093632A6169A704045D1925E0AC4382B311FDE22FAF8242454A24D7AFCB</FileHash>
<FqbnLength>69</FqbnLength>
<Fqbn>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\51.1052.0.00</Fqbn>
<TargetLogonId>0x632748</TargetLogonId>
</RuleAndFileData>
</UserData>
</Event>
VS Code version: Code 1.31.1 (1b8e830, 2019-02-12T02:20:54.427Z)
OS version: Windows_NT x64 10.0.17134
System Info
Item | Value |
---|---|
CPUs | Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz (8 x 3600) |
GPU Status | 2d_canvas: enabled checker_imaging: disabled_off flash_3d: enabled flash_stage3d: enabled flash_stage3d_baseline: enabled gpu_compositing: enabled multiple_raster_threads: enabled_on native_gpu_memory_buffers: disabled_software rasterization: enabled surface_synchronization: enabled_on video_decode: enabled webgl: enabled webgl2: enabled |
Memory (System) | 31.89GB (17.54GB free) |
Process Argv | |
Screen Reader | no |
VM | 0% |