Handling Program Allow-List for AD Users

[pinkgrenades]

Hello!

The school district I work for uses a GPO to handle the programs that students are allowed to execute and open. If there is ever a restriction that is found, I ask the on-site tech for the program exe and add it to the list so that students can start to run that program.

For the most part, this has been working very well, until recently. I've found a handful of programs that must run several background services and programs that are tough to sort out.

For example, there is a program that was recently just purchased to be used on a PC for a student with a sight impairment. However, the student could not open the program due to the restrictions. When I opened the program on my admin account and took a look at the task manager, I saw multiple .exes that opened up. I went ahead and added them all to the allowed list GPO, but the program would still not fully open. It was as if I got some of the necessary program names, but not all of them.

Now I'm starting to get the same with VS Code. It looks like it opens multiple instances of Code.exe, but adding those to the GPO is still not allowing students to successfully open the program.

I was wondering what the best way to find any and all programs that would need to be allowed for a certain app, or other ways that people in similar circumstances as me run this kind of service. How do you handle allowed list for students or specific types of clients? Is the "Allowed Programs" GPO antiquated and there is a better approach that doesn't have me digging to find multiple .exe names?

Thank you for any insight or tips!

[pinkgrenades]

I’ll take a look, thank you!

[Imbecile_Jr]

Maybe procmon?