SRPManager - AppLocker Management Utility
- Version: 2.1.4
- Author: Vladimirs Kuznecovs
- License: Copyright © 2026 Vladimir Kuznetsov
Overview
SRPManager is a system-tray utility for monitoring and managing Windows AppLocker policy.
It lets administrators enable or disable* AppLocker enforcement, view active rules, run GPUpdate /force, temporarily freeze the policy state, and inspect both standard and packaged-app (AppX) AppLocker events - all from the notification area or the command line.
Features
| Feature | Description |
|---|---|
| System tray icon | Shows the current AppLocker state (On / Off / AuditOnly / Custom / Unknown) with a distinct icon for each state |
| Enable / Disable AppLocker | Toggle AppLocker enforcement with a single click |
| Policy freeze | Temporarily lock the policy to prevent AppLocker from being re-enabled - useful during software installations |
| Event log viewer | Tab-based window showing AppLocker events for files (EXE, DLL, MSI, Script) and packaged apps (AppX) |
| Event summaries | Summarized view grouping events by file path or package name with a count of occurrences |
| Filtering | Quick search bar (space-separated terms, prefix ! to exclude) plus a detailed filter dialog |
| CSV export | Export events or rules to a CSV file |
| Remote log viewing | Connect to another machine on the network to view its AppLocker event log |
| Rules viewer | Shows all active AppLocker rules - EXE, MSI, Script, and AppX |
| Edit AppLocker rules | Opens the AppLocker rule editor directly (local machines only, requires admin rights) |
| GPUpdate | Run gpupdate /force from the tray menu |
| Audit logging | Records an entry in the Windows Application event log whenever AppLocker is enabled or disabled |
| Multi-language | English, Latvian (Latviešu), and Russian (Русский) |
| Command-line interface | Full CLI support for scripting and automation |
Command-Line Usage
SRPManager.exe [command] [options]
| Command | Aliases | Description |
|---|---|---|
| (no arguments) | Launch the system-tray GUI | |
-help | -h, -?, /? | Show help text |
-status | Show the current AppLocker state, service status, and whether the policy is frozen | |
-enable | -e | Enable AppLocker |
-enable -force | -ef | Enable AppLocker even if the policy is currently frozen |
-disable | -d | Disable AppLocker |
-logs <days> | Print AppLocker events from the last N days to the console | |
-logs <days> -gui | Open the event viewer pre-loaded with the last N days of events | |
-rules | Open the rules viewer |
Examples
SRPManager.exe -enable
SRPManager.exe -status
SRPManager.exe -logs 1
System Tray
Icon States
The tray icon always reflects the current AppLocker status:
- On - AppLocker is actively enforcing rules
- Off - AppLocker is not blocking anything
- AuditOnly - Rules are in logging mode only; nothing is blocked
- Custom - Mixed enforcement (some rule types enforced, others not)
- Unknown - Status could not be determined
Tray Menu
| Menu Item | Description |
|---|---|
| Status indicators | Read-only info: whether you are running as Administrator, whether the AppLocker service is running, and whether DLL filtering is active |
| Enable / Disable | Toggle AppLocker enforcement. A checkmark shows the current state. |
| Freeze | Lock the policy to prevent AppLocker from being re-enabled until you unfreeze it |
| Logs | View events from the last 1, 7, or 30 days; or connect to a remote machine |
| Rules | Open the active rules viewer |
| GPUpdate | Run Group Policy update |
| Settings | Open the settings window |
| About | Version and license information |
| Exit | Close SRPManager |
Event Log Viewer
The event viewer opens as a tabbed window with four tabs:
- File Events - Individual AppLocker events for EXE, DLL, MSI, and Script files
- File Event Summary - Events grouped by file path, showing how many times each was allowed or blocked
- AppX Events - Events for packaged (Store) applications
- AppX Event Summary - Events grouped by package name
Filtering
- Quick filter bar - Type one or more words to show only matching rows. Prefix a word with
!to exclude it (e.g.,explorer !system). - Filter dialog - Build structured filters using Contains, Equals, StartsWith, EndsWith, or Regex.
- Checkboxes - Quickly hide DLL events, hide Windows system events, or show only your own user’s events.
Right-click Options
Right-click any event row to open the containing folder, copy the file path or publisher, filter by that user or file, or exclude a file from the current view.
Connecting to a Remote Machine
Go to Logs > Connect to… in the tray menu. Enter a hostname (e.g., SERVER01) and optionally a timeframe (e.g., SERVER01; 7d for the last 7 days). The last 10 remote hosts you connected to are remembered. The remote machine must have the Windows Event Log service running and accessible over the network.
Rules Viewer
Shows all active AppLocker rules parsed from the current Effective policy. Columns include rule type, enforcement mode, action (Allow/Deny), the rule name, who it applies to, and the path, publisher, or hash condition.
Use the search bar to filter rules. You can export the full list to CSV.
Edit AppLocker Rules (admin only, local machines only) - Opens the built-in AppLocker rule editor so you can make changes directly. (hidden when DomainMode=1, see #)
AppLocker States Explained
| State | What it means |
|---|---|
| On | AppLocker is enforcing rules - unauthorized programs will be blocked |
| Off | AppLocker is not blocking anything (service stopped, no rules configured, or rules allow everything) |
| AuditOnly | Rules exist but only generate log entries; nothing is actually blocked |
| Custom | Unusual configuration - some rule types are enforced while others are not |
| Unknown | SRPManager could not determine the state (check if PowerShell is available) |
Settings
Open settings from the tray menu. User settings take priority over machine-wide defaults set by an administrator.
| Setting | Description |
|---|---|
| Run at startup | Start SRPManager automatically when you log in |
| Always show tray icon | Keep the icon visible in the taskbar notification area |
| Language | Choose between English, Latvian, or Russian |
| Domain mode (admin-set) | When enabled, the “Enable AppLocker” action uses a transitional policy that avoids conflicting with domain Group Policy. Intended for domain-joined machines. |
| Copy policy files | Copies the built-in policy files to C:\Windows\AppLocker\Policies\ (requires admin rights, not needed on domain-joined machines) |
Deploy in domain
When deploying at scale, it is recommended to use registry keys to configure app default look and behavior. Settings are stored in the Windows registry under
HKCU\SOFTWARE\SRPManager(user)HKLM\SOFTWARE\SRPManager(machine defaults).- The Settings dialog is accessible from the tray icon’s context menu.
- Values set by User are saved in the
HKCUregistry hive. HKCUvalues have a priority overHKLM.HKLMkeys can be used to set the default values for the tool in the domain environment, when deploying.
| Setting | Key | Type | Description |
|---|---|---|---|
| Always show tray icon | PinToTray | DWORD | Pins app icon to the taskbar corner for easier access |
| Language | Language | String | Default UI language, supported values are: en|lv|ru |
| Domain mode | DomainMode (HKLM) | DWORD | When set to 1, the enable flow uses AppLocker-EnableNotConfigured.xml (NotConfigured) instead of the full policy, to avoid overlapping with domain GPO policy |
Policy Files
SRPManager includes three ready-to-use AppLocker policy files:
| File | Purpose |
|---|---|
AppLocker-Enable.xml | Full enforcement policy. Allows programs from Windows\, Program Files\, and Microsoft-signed binaries. User-writable paths and known LOLbin tools are excluded. |
AppLocker-EnableNotConfigured.xml | A transitional policy used on domain-joined machines - clears local settings so that the domain Group Policy can take over after a GPUpdate. |
AppLocker-Disable.xml | Disables AppLocker enforcement entirely. |
Audit Log
Every time AppLocker is enabled or disabled through SRPManager, an entry is written to the Windows Application event log:
| Event ID | Meaning |
|---|---|
| 1000 | AppLocker was enabled (includes user, machine, and timestamp) |
| 1001 | AppLocker was disabled (includes user, machine, and timestamp) |
Requirements
- Windows 7 or later (Windows 10 / 11 recommended)
- .NET Framework 4.6.2
- Administrator rights required for enabling/disabling AppLocker