FortiClient - Post Connection Script with CMD blocked by AppLocker

[andyhill]

In our environment applocker blocks cmd.exe which appears to be what the Post Connection login script uses to launch any of the post connection commands. 

Has anyone else come across this and found a work around that does not require CMD to be unblocked?

[Anthony_E]

Hello Andy,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hi Andy,

I have found this reddit discussion:

https://www.reddit.com/r/Intune/comments/riny30/help_needed_with_applocker/

May I ask you to check and tell me if it helped?

Regards,

[andyhill]

Hi Anthony_E, thanks for the response. 

That link really didn't tell me anything, I understand how AppLocker works (I configured it). The issue here is that my organisation whats CMD.exe to remain blocked but anything added to the FortiClient post script connection such as the below spawns a CMD to run the commands even if that command is run a powershell:

<on_connect>
<script>
<os>windows</os>
<script><![CDATA[eventcreate /d "This is my sample event" /t information /id 10
powershell.exe -ExecutionPolicy Bypass -File "C:\Temp\Temp\Temp.ps1"]]></script>
</script>
</on_connect>

Because FortiClient spawns CMD.exe from its default directory there is no way for me to bypass the applocker rule I would have to turn it off completely. 

I was looking to see if anyone else had come across this before and found a way to either use the login script where CMD.exe was not required or clevely bypass it. I can't imagine we are the only organisation that blocks CMD.exe.

[Anthony_E]

Hello Andy,

Well noted.

I will try to find somebody who has already faced this situation to give an answer.

Regards,

[andyhill]

Hi Anthony_E

So I enabled cmd.exe on my machine in AppLocker just in case I can convince the business to allow it but the issue is even with that enabled the FortiClient is spawning .CMD files in the Temp user folder under random names to run the scripts. 

There is no way I can get sign off to allow randomnly named .CMD files to run from a users temp folder, thats just too big a security hole. 

I really think the dev team should spend some time getting a better post script system set up that does not require such a security hole.

[Anthony_E]

Hello Andy,

I will share your message with the concerned Team.

Regards,

[wdeman]

I was struggling with the same issue, we have AppLocker blocking this as well. There is a solution, you can allow a file hash rule in your AppLocker's Script Rules. Grab the CMD file that FortiClient will run on connect, import the file hash of that CMD and Allow that hash to run.

Downside of this is that with every change of the On Connect (or On Disconnect) script you'll have to update the AppLocker policy to the new file hash.

I have tested it (EMS 7.0.8 & FortiClient 7.0.8), and it works, even the same script content copied to other Remote Access policies / VPN tunnels works.