NIERO@net e.K. – Corporate Blog

Wir sichern Ihre digitalen Unternehmenswerte!

Verteilen von EMET via Gruppenrichtlinien

Die aktuelle 0-Day-Lücke im Internet Explorer bringt uns zu der Frage, wie man EMETv3 mangels SCCM via Group Policies verteilt.

Das Benutzerhandbuch von EMET beschreibt nur einen kleinen Teil des Weges:

EMET 3.0 comes with group policy support. When you install EMET, EMET.admx and EMET.adml files are also installed to the “Deployment\Group Policy Files” folder. These files can then be copied onto \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US folders respectively. Once this is done, EMET system and application mitigation settings can be configured via Group Policy.

There are three sets of policies that EMET exposes. Below is a description of each. More information can be found at the policy editor for each policy.
1. System Mitigations: Named ASLR, DEP and SEHOP, these policies are used to configure system mitigations. Please note that modifying system mitigation settings may require a reboot to be effective.
2. Default Protection Profiles: There are three: Internet Explorer, Office applications and other popular software. Protection Profiles are pre-configured EMET settings that cover common home and enterprise software. Apply these policies to enable them.
3. Application Settings: This leads to a freeform editor where you can configure any additional applications not part of the default protection profiles. The syntax is application executable name followed by an optional list of mitigations you don’t want to enable. If you don’t specify any mitigation, all seven EMET application mitigations will be enabled.

Once you enable EMET Group Policies, they will be written out to the registry at HKLM \SOFTWARE\Policies\Microsoft\EMET. To make them effective in EMET, you have to run the following command using the EMET Command Line Tool.

EMET_Conf –refresh

Please note that when you apply a Group Policy in Windows, there is often a short delay before Group Policy writes them out to the registry.
You can run this command separately, at startup or at logon time according to your deployment strategy.
To view the Group Policy controlled EMET settings, run the following command using the EMET Command Line Tool.

EMET_Conf –list

The settings controlled by Group Policy start with the ‘>’ character. In this example, we have 2 settings and the Internet Explorer one has been configured by Group Policy, while the program.exe setting has been configured either through the EMET Graphical User Interface or the EMET Command Line Tool.

It is important to note that the settings configured via Group Policy take precedence over the settings configured locally using the EMET GUI or the EMET Command Line Tool. Also, Group Policy controlled settings can only be modified or deleted via Group Policy. For example, running

EMET_Conf –delete_all

in the situation above would only delete the program.exe settings, and leave Internet Explorer settings intact.”

Wir haben aber sicherlich mehrere Computer auf denen wir EMET installieren wollen und – wie man oben sieht – müssen wir zur Übernahme des vorher konfigurierten EMET-GPO ein “EMET_Conf –refresh” auf jeder Maschine ausführen. Genau das ist die Krux.

Die Lösung ist – neben einem Startskript – das kleine Tool psexec von Sysinternals. Mark erklärt in einem Artikel die Benutzung.

Angemerkt sei hier, das “EMET-Conf –refresh” als Administrator ausgeführt werden muss.

Welche Schritte haben wir nun?

1. Herunterladen von EMET

2. Installation von EMET auf einem Referenzcomputer

3. Konfiguration des EMET-GPO:

Diese befinden sich – wie oben geschrieben – im Ordner /EMET/Deployment/Group Policy Files und müssen in den Ordner /Windows/PolicyDefinitions kopiert oder besser in einen Central Store unter sysvol.

EMET GPO

Continue reading

21. September 2012 Posted by | Lessons learned: Notes from the field | , , , , , , , , , , , , , , , , , | Kommentare deaktiviert für Verteilen von EMET via Gruppenrichtlinien