question

Nowtside-5323 avatar image
0 Votes"
Nowtside-5323 asked JennyYan-MSFT answered

Automatically restart computer when Applocker service is stopped?

Since Applocker sends no "service started" or "service stopped" events in event viewer i wonder if there is another way to do this. Basically whenever the application identity service i stopped i want to run a script. I have tried this solution for Group Policy objects and Windows defender firewall with event viewer but i wonder how can i do this with Applocker?

windows-10-general
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I understood, you want to set a command like when AppLocker stops working, then restart the PC?
I am wondering why not restarting the service instead?
It would be better to investigate the cause of service stopping and fix it , instead of restarting the PC.

0 Votes 0 ·

For security reasons the computer cant be functional while one of the security features are off. Restarting the service could be a solution too but i need the process to be automatic and trigger whenever Applocker is stopped. My question really is if there is any way to run a task whenever the service stops.

0 Votes 0 ·
JennyYan-MSFT avatar image
0 Votes"
JennyYan-MSFT answered Nowtside-5323 commented

Hi,

From Task scheduler perspective, the task will be executed based on triggers pre-set when creating this task.
Task Scheduler provides both time-based and event-based triggers that can start a task in several different ways. A given task can be started by one or more triggers. A task can have a maximum of 48 triggers.

Once you confirmed the dedicated event log will be written when you set up the triggers, you can choose the event-based triggers as a test.

Detailed steps could be referred to below link with screenshot:
How to configure a schedule task which is triggered by an event?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/fac16f3c-d088-4d66-83d8-7139261dea83/forum-faq-how-to-configure-a-schedule-task-which-is-triggered-by-an-event?forum=winservergen

https://docs.microsoft.com/en-us/windows/win32/taskschd/task-triggers



Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

This is what i want to set up. But i cant find any event related to stopping the Application Identity or Applocker service. I dont know what trigger to use in order to accomplish the task of restarting the computer whenever Application Identity service stops.

0 Votes 0 ·
JennyYan-MSFT avatar image
0 Votes"
JennyYan-MSFT answered

Hi,
From Task scheduler perspective, the dedicated event ID is the fundamental value to process the event trigger and it is not possible to start the scheduled task without triggers.

Therefore, maybe you could consult some other methods like monitoring the changes reflects to the registry value when Applocker service or Application Identity was modifed and then costomize some scripts to restart the computer.

Following are some reference links and wish they could give you some other inspiration.

Reference links:
https://stackoverflow.com/questions/59164327/how-to-stop-and-resume-protected-triggered-windows-service-appidsvc-applocker
https://serverfault.com/questions/935283/execute-a-windows-task-triggered-by-registry-changes
https://social.msdn.microsoft.com/Forums/vstudio/en-US/56e3222b-b7cf-484a-b59c-977437514f79/scheduling-a-task-to-trigger-off-a-registry-change?forum=vbgeneral

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.



Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.