If a user is required to host meetings on a regular basis, with GoToMeeting or a different service, make sure the software is set up in advance and works on their local desktop. Use Virtualization to Solve Problems of Privilege If you’re using a mix of Windows versions, Privilege Guard can manage application privileges and implement allow listing in XP and later so that one set of rules are applied to all your Windows systems. Once rules to allow the 5 executables listed in Table 1 are added to AppLocker, you should find that users can join and host meetings. The appcore executable isn’t signed, so you’ll need to create a file hash or path file rule to prevent AppLocker from blocking it.
You can either enable AppLocker and add a rule for each executable as it’s blocked or install GoToMeeting with AppLocker disabled and then run the Automatically Generate Rules wizard and allow AppLocker to discover the necessary runtimes. Figure 1 shows how the file name on disk and the file name displayed in the AppLocker wizard differ, adding some confusion to the process.įor the purposes of adding the GoToMeeting runtimes to AppLocker, you’ll find most of the executables located in the logged in user’s TEMP directory (%username%\appdata\local\temp). Suffice to say that following best practice, you should configure publisher rules for the GoToMeeting runtimes wherever possible. Assuming you’ve already enabled AppLocker in Windows 7, I won’t explain here how to create rules, as no doubt that’s something you already know how to do. Rules will be required for 5 executables as shown in Table 1. Creating rules for Windows 7 AppLocker to allow GoToMeeting to run needs a little preparation because of the slightly convoluted nature in which GoToMeeting installs and runs. If you’ve configured application allow listing to provide an extra layer of defense, you’ll need to make the necessary exceptions so users can install and update GoToMeeting. One exception is that administrative privileges are needed to install GoToMeeting’s recording codec, but if you don’t need to record a meeting, you’re good to go without it. That may come as a surprise to some system administrators, as it’s often assumed that admin rights are required to install and update the software. In this post I’ll focus on GoToMeeting, but some of the information could also be applied to other software.Ĭitrix has engineered GoToMeeting so that it doesn’t require any special privileges to install. This kind of software can pose a problem as users are often requested to join meetings at short notice and need to install a client program to participate in the conference.
One of the comments I receive most frequently from attendees of my Least Privilege webinar is that web conferencing software, such as Citrix’s popular GoToMeeting, prevents IT departments moving forward with least privilege on the desktop.