App Control for Business or Windows Defender Application Control (WDAC) allows organizations to control which applications should be run in Windows clients or Windows Servers.
WDAC can secure your organization from harmful applications that can be run on Windows devices. App Control for Business is the replacement of AppLocker. I tried to use it years ago. However, while I tested I found many limitations and I stopped using it.
Today THE WDAC is much easier to install with a lot of improvements. So I decided to start testing again.
Prerequisites
Windows Defender Application Control (WDAC) can be used in any Windows 10, Windows 11, or on Windows Server 2016 and higher. However, some of the features can be used only in specific Windows Versions. Windows Defender Application Control (WDAC) policies can be deployed in any of the following ways.
- Intune
- Configuration Manager
- Script
- GPO
Each of the ways has advantages and disadvantages. It does not exist in the perfect way. Every company can deploy the WDAC Policies based on the infrastructure that they have.
For example, if a company has Intune and a lot of employees working out of the company, the better way is to use Intune instead of a Group Policy.
Features
The table is reference from Microsoft Learn
|
How to create a WDAC Policy
If you have decided that WDAC can fulfill your requirements it's time to start working with the Windows Defender Application Control Policies.
We have created the following scenario
- Windows Defender App Control Wizard will be used to create the Policies.
- We will use the Allow Microsoft Mode Template Policy.
- We will use GPO to deploy the Policy.
- We allow only the Java Application.
So let's start !!!
- Download and install the Windows Desktop Runtime 8 which is required from Windows Defender App Control Wizard.
- Download the Windows Defender App Control Wizard. The last version is the 2.4.4.0
- You can install the Windows Defender App Control Wizard on your PC to create the Policies that you will deploy.
- After the installation open the Windows Defender App Control Wizard and click Launch.
- Click on Policy Creator.
- Because we will deploy the Policy with GPO we can use only the Single Policy Format. Click next.
- Windows Defender App Control Wizard offers 3 Template Policies.
- Default Windows Mode
- Allow Microsoft Mode
- Signed and Reputable Mode
- You can use any of the templates. However, for our scenario, we will use the Allow Microsoft Mode. Check the Allow Microsoft Mode.
- If you want you can change the Policy Name and the file location that will be saved. Click Next
- The Policy Rules are pre-set based on the template that has been chosen. However, you can change it if you want.
- If it's the first time that you will deploy a WDAC Policy it's recommended to leave the Policy Rules as it. When you will understand how the WDAC behaves then you can start to play with the Rules.
- Be careful to keep the Policy Rule in Audit Mode. It's very important because you can cause chaos in your company if you enforce the rule by mistake. Click Next.
- These are the Policy Signing Rules List based on the Policy Template.
- We will not change anything for now. We need to learn and then start to play with the Rules. Click Next
- The WDAC policy was created and included 2 files. The .xml file and the .p7b file.
- The .p7b file will be used in GPO to deploy the policy.
How to Deploy the WDAC Policy with GPO
Now that we have created the WDAC Policy let's go to Deploy it.
- Find out a shared location to save the .p7b file.
- Login to the Domain Controller and open the Group Policy Management.
- Create a new policy. Apply the Policy to the Organization Unit which includes the Computers that you want to secure.
- Go into Computer Configuration - - Policies -- Administrative Templates - System --Device Guard.
- Right-click and select Edit in Deploy Windows Defender Application Control.
- Enable the policy and give the UNC Path to which the .p7b file is located. Remember that you should already save it in a shared location as mentioned in the first step.
- Now you should wait until the GPO is deployed to the computers. Unless you can select one of the computers for that you have to apply the Policy and run the gpupdate /force. When the PC restarted the WDAC Policy will be applied.
The deployment with GPO it's easy. Let's continue to identify from the Logs if the WDAC Policy has been applied or not.
- Open the Event Logs
- Go to the Microsoft-Windows-CodeIntegrity/Operational.
- Check the Logs that was generated as in printscreen.
- If you can see Log with Event id 3099 it means that the WDAC Policy loaded.
- Then you will see logs with Event ID 3076 which indicate that a file blocked but is in audit mode.
How to analyze events from WDAC
After the WDAC Policy is deployed in audit mode you must be able to analyze the Logs from each Computer.
This will take hours and maybe days until decide which applications must be allowed.
The only exception is in case you have strict directions to allow only specific Applications and anything else should be blocked. However, this is very rare and most of the time you are the person who should identify which applications must be allowed.
Let's see how to manage this task.
Before beginning take note that .NET native images may generate false positive block events. This is a known issue from Microsoft in App Control Admin Tips & Known Issues.
So in case you get Logs like the following don't do anything. It will not have any impact when you Enforce the WDAC Policy.
- Let's start to search in Logs to find out Applications that should be blocked or allow.
- In our scenario, we want to allow only the Java Application. So I found the following in the Logs that can help me allow the Java application.
Let's continue with the next steps.
How to Edit WDAC Policy
We are ready to edit the WDAC Policy, deploy it again and verify that it's working as expected.
- Open the Windows Defender App Control Wizard and click Launch.
- Click on Policy Editor
- Select the XML file of the WDAC Policy that we created. Click next
- Leave the Policy Rules as it and the Audit Mode as well. Click next
- Click Add Custom.
- The Rule Scope should be in UserMode
- The Rule Action -- Allow
- For the Rule Type select Path. Check the Folder.
- Click Browse and find the Folder Path.
- For our scenario, the folder path is 'C:\Program Files (x86)\Java'
- Click Next to create the files for the WDAC Policy.
- Copy the new file .p7b and replace it with the UNC location that we are using in GPO.
- Select a PC or Server to which the WDAC Policy is applied and run the gpupdate /force.
- After the PC or Server restarted open the Java and check the Logs to see if you will get again the previous error.
- If not that means the WDAC Policy applied.
This is a very basic article about the WDAC and how to start using it.
I hope to help you understand how to use WDAC in your environment.