应用程序白名单实现

Windows 10’s Creators Update has a switch you can flip to only allow apps from the Windows Store. This feature can also be used to whitelist your existing desktop apps, only allowing your currently installed applications to run and blocking new applications until you allow them. It’s similar to Gatekeeper on macOS.

Windows 10的Creators Update具有一个开关，您可以将其切换为仅允许Windows应用商店中的应用程序。 此功能还可用于将您现有的桌面应用列入白名单，仅允许您当前安装的应用运行并阻止新应用，直到您允许它们为止。 它类似于macOS上的Gatekeeper 。

如何仅从商店运行应用程序 (How to Run Only Apps From the Store)

You’ll find this option under Settings > Apps > Apps & Features after upgrading to the Creators Update. Under “Installing Apps”, you can select either “Allow apps from anywhere”, “Warn me before installing apps from outside the Store”, or “Allow apps from the Store only”. The default option allows you to run applications from anywhere, which is the way Windows has traditionally worked.

升级到创作者更新后，您可以在设置>应用>应用和功能下找到此选项。 在“安装应用程序”下，您可以选择“允许从任何地方使用应用程序”，“在从商店外部安装应用程序之前警告我”或“仅允许从商店使用应用程序”。 默认选项允许您从任何地方运行应用程序，这是Windows传统上的工作方式。

At the moment, choosing to run only applications from the Windows Store is a bit limiting. Many applications aren’t available in the Windows Store, including the desktop versions of Microsoft’s own Office applications. However, as more desktop applications are packaged for the Windows Store via Project Centennial, blocking desktop applications from elsewhere may become a useful security feature to help prevent malware from being installed on your system.

目前，选择仅运行Windows应用商店中的应用程序是有一定限制的。 Windows应用商店中没有许多应用程序，包括Microsoft自己的Office应用程序的桌面版本。 但是，随着越来越多的桌面应用程序通过Project Centennial为Windows Store打包，从其他地方阻止桌面应用程序可能会成为有用的安全功能，以帮助防止恶意软件安装在系统上。

如何将特定的桌面应用列入白名单 (How to Whitelist Specific Desktop Apps)

If you select “Allow apps from the Store only”, you’ll still be able to run all the desktop apps you’ve already installed. However, if you download an .exe file or other app from the Internet and try to run or install it, you’ll see a message saying the installation was blocked.

如果您选择“仅允许来自商店的应用程序”，您仍然可以运行已安装的所有桌面应用程序。 但是，如果您从Internet下载.exe文件或其他应用程序并尝试运行或安装它，则会看到一条消息，说明安装被阻止。

Want to install the app anyway? Click the “Open Settings” link or head back to Settings > Apps > Apps & Features and set the option to “Allow apps from anywhere”. Install the app normally. After you do, you can set the option back to “Allow apps from the Store only”. The app you just installed will be given permission to run, while future apps you install won’t have it.

是否仍要安装该应用程序？ 点击“打开设置”链接或返回设置>应用>应用和功能，然后将选项设置为“允许任何地方的应用”。 正常安装应用程序。 完成后，您可以将选项设置回“仅允许来自商店的应用”。 您刚刚安装的应用将被授予运行权限，而将来安装的应用将没有运行权限。

While the wording here refers to “installing applications”, this also works for self-contained .exe files like portable apps. When you download a new .exe file, Windows will prevent you from opening it. If you tell Windows to run all software, you can then launch the .exe file. Tell Windows to block apps from outside the Store afterwards and you’ll still be able to run that .exe file and any other apps you’ve already run.

尽管此处的措辞是指“安装应用程序”，但它也适用于自包含的.exe文件，如便携式应用程序 。 当您下载新的.exe文件时，Windows会阻止您打开它。 如果告诉Windows运行所有软件，则可以启动.exe文件。 告诉Windows之后再从商店外部阻止应用程序，您仍然可以运行该.exe文件以及已经运行的任何其他应用程序。

You can also choose the “Warn me before installing apps from outside the Store” option to save time. When you try to run or install a new app file, it will be blocked but you can click “Install anyway” to give the app permission to run. You’ll only have to give it permission once, and it will be allowed to run without any additional prompts in the future.

您还可以选择“在从商店外部安装应用程序之前警告我”选项，以节省时间。 当您尝试运行或安装新的应用程序文件时，该文件将被阻止，但是您可以单击“仍然安装”以授予该应用程序运行权限。 您只需要授予一次权限，以后就可以运行它而无需任何其他提示。

This feature is pretty interesting because it gives Windows desktop users an easy way to whitelist desktop apps, something that’s normally restricted to Enterprise and Education editions of Windows with AppLocker. Once you get the apps you use installed, you can flip this switch to block new apps from running without your express permission.

此功能非常有趣，因为它为Windows桌面用户提供了一种将桌面应用程序列入白名单的简便方法，而通常仅限于带有AppLocker 的Windows企业版和教育版 。 一旦安装了要使用的应用程序，就可以翻转此开关，以阻止新应用程序在未经您明确许可的情况下运行。

This sort of whitelisting was previously possible on any edition of Windows 7 and 8 via Family Safety, but that feature was removed from Windows 10. This new “Installing apps” option allows you to set up a basic form of whitelisting once again.

以前可以通过家庭安全在任何版本的Windows 7和8上进行这种白名单，但是从Windows 10中删除了该功能。新的“安装应用程序”选项使您可以再次设置白名单的基本形式。

翻译自: https://www.howtogeek.com/302352/how-to-allow-only-apps-from-the-store-on-windows-10-and-whitelist-desktop-apps/

应用程序白名单实现