title: How to stop and resume protected triggered Windows service AppIDSvc (AppLocker)
body: <p>The goal is to control the <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview" rel="nofollow noreferrer">AppLocker</a> by temporarily stopping the AppIDSvc (Application Identity) Windows service and then resuming its execution. The action is supposed to be performed from within another Windows service with elevated permissions under the SYSTEM user security context.</p>
  
  <p>By default, the AppIDSvc service startup type is Manual (Trigger Start). It means that even if the service is stopped with <a href="https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicecontroller.stop" rel="nofollow noreferrer"><code>ServiceController.Stop</code></a> method or <code>sc stop AppIDSvc</code> command, it will be triggered and started again by any AppLocker event, e.g. an executable is launched.</p>
  
  <p>Since it’s a <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service" rel="nofollow noreferrer">protected service</a>, calling <a href="https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-changeserviceconfigw" rel="nofollow noreferrer"><code>ChangeServiceConfig</code></a> WinAPI function or <code>sc config AppIDSvc start= disabled</code> to disable the service returns "Access Denied" error.</p>
  
  <p>Attempting to <a href="https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.process.kill" rel="nofollow noreferrer">kill</a> the service process, even from within the SYSTEM user security context, also leads to "Access Denied".</p>
  
  <p>The only method that worked for me was to change the registry value <code>Start</code> in <code>HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc</code> to <code>4</code> and then restart a computer. Unfortunately, this method is not suitable because of the computer restart.</p>
  
  <p>There could also be the following solution based on <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets" rel="nofollow noreferrer">AppLocker PowerShell cmdlets</a>:<br>
  1) backup existing AppLocker rules;<br>
  2) import “Allow Everything to Everyone” rules with “overwrite existing” option;<br>
  3) recover existing ones after the operation.<br>
  It is proved to be working, but also not suitable: it will only substitute local GPO rules, Domain rules will not be overwritten, and the solution needs to work in Domain corporate networks.</p>
  
  <p>Can anyone give advice? Also, the solution mustn't degrade native Windows security. At the same time, we can rely on the fact that customers are aware and, even more, they intend to pause the AppLocker for a certain amount of time.</p>