AppLocker policies are located in the Computer Configuration\Windows Settings\ Security Settings\Application Control Policies node of a standard Windows 7 or Windows Server 2008 R2 GPO.
The Application Compatibility Toolkit (ACT) is a collection of tools that allows you to resolve application compatibility issues. You can use the ACT to determine whether existing applications are compatible with Windows 7 before deploying the new operating system.
The ACT contains the following components:
Application Compatibility Manager
Compatibility Administrator
Internet Explorer Compatibility Test Tool
Setup Analysis Tool
Standard User Analyzer
You learn more about each of these tools in the rest of this lesson.
EXERCISE 1: Configuring Computer Policy to Allow Non-Administrators to Install Specific Device Setup Classes
This exercise permits a non-administrative user to install any imaging device (such as a webcam) that has a signed driver on the Canberra computer. You first determine the GUID of the Imaging Devices setup class and then configure computer policy to permit non-administrators to install this class of device. The exercise requires that at least one device of that setup class is installed on your computer. If not, use another setup class. You need to know the procedure—the actual device setup class you choose is not important. To permit non-administrators to install a specific type of hardware device, perform the following procedure:
Log on to the Canberra computer with the Kim_Akers account.
If the Don Hall non-administrator (ordinary user) account does not already exist, create it.
Open Device Manager.
Expand Imaging Devices in the Device Manager tree. Select a device (such as a webcam).
Right-click the device and choose Properties.
On the Details tab, in the Property list, click Device Class Guid, as shown in Figure 4-23.
Figure 4-23: Determining a device class GUID
The GUID is displayed, as shown in Figure 4-24. Right-click the GUID and choose Copy. Paste the GUID into Microsoft Notepad so you do not lose it.
Figure 4-24: Monitor device type GUID
Click Start. Enter mmc gpedit.msc in the Start Search box and press Enter. This starts Local Group Policy Object Editor.
In Local Group Policy Object Editor, under Local Computer Policy, double-click Computer Configuration, double-click Administrative Templates, double-click System, and select Driver Installation.
In the details pane, double-click Allow Non-Administrators To Install Drivers For These Device Setup Classes, as shown in Figure 4-25.
Figure 4-25: Accessing the Allow Non-Administrators To Install Drivers For These Device Setup Classes policy
In the Allow Non-Administrators To Install Drivers For These Device Setup Classes dialog box, shown in Figure 4-26, select Enabled.
Figure 4-26: Enabling the Allow Non-Administrators To Install Drivers For These Device Setup Classes policy
Click Show.
In the Show Contents dialog box, select the text box under Value to highlight it, double-click the text box, and paste the GUID you copied earlier (including the curly braces). The Show Contents box should be similar to Figure 4-27.
Figure 4-27: Pasting the GUID into the Show Contents dialog box
Click OK to close the Show Contents dialog box.
Click OK to close the Allow Non-Administrators To Install Drivers For These Device Setup Classes dialog box. Local Group Policy Editor shows the policy is Enabled.
If you want, stage the driver for a reputable third-party imaging device. Then log on to the Canberra computer as Don Hall and install the device. Staging a driver is described in Exercise 2.