How to use the Windows Defender Application Control

App Control for Business or Windows Defender Application Control (WDAC) allows organizations to control which applications should be run in Windows clients or Windows Servers.

WDAC can secure your organization from harmful applications that can be run on Windows devices. App Control for Business is the replacement of AppLocker. I tried to use it years ago. However, while I tested I found many limitations and I stopped using it.

Today THE WDAC is much easier to install with a lot of improvements. So I decided to start testing again.

Prerequisites

Windows Defender Application Control (WDAC) can be used in any Windows 10, Windows 11, or on Windows Server 2016 and higher. However, some of the features can be used only in specific Windows Versions.  Windows Defender Application Control (WDAC) policies can be deployed in any of the following ways.

• Intune
• Configuration Manager
• Script
• GPO

Each of the ways has advantages and disadvantages.  It does not exist in the perfect way. Every company can deploy the WDAC Policies based on the infrastructure that they have.

For example, if a company has Intune and a lot of employees working out of the company, the better way is to use Intune instead of a Group Policy.

Features

The table is reference from Microsoft Learn

Capability App Control for Business AppLocker Platform support Available on Windows 10, Windows 11, and Windows Server 2016 or later. Available on Windows 8 or later. Edition availability Available on Windows 10, Windows 11, and Windows Server 2016 or later. App Control PowerShell cmdlets aren't available on Home edition, but policies are effective on all editions. Policies are supported on all editions Windows 10 version 2004 and newer with KB 5024351. Windows versions older than version 2004, including Windows Server 2019: Policies deployed through GP are only supported on Enterprise and Server editions. Policies deployed through MDM are supported on all editions. Management solutions Intune Microsoft Configuration Manager (limited built-in policies or custom policy deployment via software distribution) Group policy Script Intune (custom policy deployment via OMA-URI only) Configuration Manager (custom policy deployment via software distribution only) Group Policy PowerShell Per-user and Per-user group rules Not available (policies are device-wide). Available on Windows 8+. Kernel mode policies Available on Windows 10, Windows 11, and Windows Server 2016 or later. Not available. Rule option 11 - Disabled:Script Enforcement Available on all versions of Windows 10 except 1607 LTSB, Windows 11, and Windows Server 2019 and above. Disabled:Script Enforcement isn't supported on Windows Server 2016 or on Windows 10 1607 LTSB and shouldn't be used on those platforms. Doing so results in unexpected script enforcement behaviors. MSI and Script rule collection is separately configurable. Per-app rules Available on Windows 10, Windows 11, and Windows Server 2019 or later. Not available. Managed Installer (MI) Available on Windows 10, Windows 11, and Windows Server 2019 or later. Not available. Reputation-Based intelligence Available on Windows 10, Windows 11, and Windows Server 2019 or later. Not available. Multiple policy support Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022. Not available. Path-based rules Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022 or later. Exclusions aren't supported. Runtime user-writeability checks enforced by default. Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. COM object allowlisting Available on Windows 10, Windows 11, and Windows Server 2019 or later. Not available. Packaged app rules Available on Windows 10, Windows 11, and Windows Server 2019 or later. Available on Windows 8+. Enforceable file types Driver files: .sys Executable files: .exe and .com DLLs: .dll, .rll and .ocx Windows Installer files: .msi, .mst, and .msp Scripts: .ps1, .vbs, and .js Packaged apps and packaged app installers: .appx Executable files: .exe and .com [Optional] DLLs: .dll, .rll and .ocx Windows Installer files: .msi, .mst, and .msp Scripts: .ps1, .bat, .cmd, .vbs, and .js Packaged apps and packaged app installers: .appx Application ID (AppId) Tagging Available on Windows 10, version 20H1 and later, and Windows 11. Not available.

 

How to create a WDAC Policy

If you have decided that WDAC can fulfill your requirements it's time to start working with the Windows Defender Application Control Policies.

We have created the following scenario

• Windows Defender App Control Wizard will be used to create the Policies.
• We will use the Allow Microsoft Mode Template Policy.
• We will use GPO to deploy the Policy.
• We allow only the Java Application.

So let's start !!!

• Download and install the Windows Desktop Runtime 8 which is required from Windows Defender App Control Wizard.
• Download the Windows Defender App Control Wizard. The last version is the 2.4.4.0 
• You can install the Windows Defender App Control Wizard on your PC to create the Policies that you will deploy.
• After the installation open the Windows Defender App Control Wizard and click Launch.
• Click on Policy Creator.

• Because we will deploy the Policy with GPO we can use only the Single Policy Format. Click next.

 

• Windows Defender App Control Wizard offers 3 Template Policies.
  • Default Windows Mode
  • Allow Microsoft Mode
  • Signed and Reputable Mode
• You can use any of the templates. However, for our scenario, we will use the Allow Microsoft Mode. Check the Allow Microsoft Mode.
• If you want you can change the Policy Name and the file location that will be saved. Click Next

 

• The Policy Rules are pre-set based on the template that has been chosen. However, you can change it if you want.
• If it's the first time that you will deploy a WDAC Policy it's recommended to leave the Policy Rules as it. When you will understand how the WDAC behaves then you can start to play with the Rules.
• Be careful to keep the Policy Rule in Audit Mode. It's very important because you can cause chaos in your company if you enforce the rule by mistake. Click Next.

 

• These are the Policy Signing Rules List based on the Policy Template.
• We will not change anything for now. We need to learn and then start to play with the Rules. Click Next

 

• The WDAC policy was created and included 2 files. The .xml file and the .p7b file.

 

• The .p7b file will be used in GPO to deploy the policy.

 

How to Deploy the WDAC Policy with GPO

Now that we have created the WDAC Policy let's go to Deploy it.

• Find out a shared location to save the .p7b file.
• Login to the Domain Controller and open the Group Policy Management.
• Create a new policy. Apply the Policy to the Organization Unit which includes the Computers that you want to secure.
• Go into Computer Configuration - - Policies -- Administrative Templates - System --Device Guard.
• Right-click and select Edit in Deploy Windows Defender Application Control.
• Enable the policy and give the UNC Path to which the .p7b file is located. Remember that you should already save it in a shared location as mentioned in the first step.

 

• Now you should wait until the GPO is deployed to the computers. Unless you can select one of the computers for that you have to apply the Policy and run the gpupdate /force. When the PC restarted the WDAC Policy will be applied.

The deployment with GPO it's easy. Let's continue to identify from the Logs if the WDAC Policy has been applied or not.

• Open the Event Logs
• Go to the Microsoft-Windows-CodeIntegrity/Operational.
• Check the Logs that was generated as in printscreen.
• If you can see Log with Event id 3099 it means that the WDAC Policy loaded.

 

• Then you will see logs with Event ID 3076 which indicate that a file blocked but is in audit mode.

 

How to analyze events from WDAC

After the WDAC Policy is deployed in audit mode you must be able to analyze the Logs from each Computer.

This will take hours and maybe days until decide which applications must be allowed.

The only exception is in case you have strict directions to allow only specific Applications and anything else should be blocked. However, this is very rare and most of the time you are the person who should identify which applications must be allowed.

Let's see how to manage this task.

Before beginning take note that .NET native images may generate false positive block events. This is a known issue from Microsoft in App Control Admin Tips & Known Issues.

So in case you get Logs like the following don't do anything. It will not have any impact when you Enforce the WDAC Policy.

• Let's start to search in Logs to find out Applications that should be blocked or allow.
• In our scenario, we want to allow only the Java Application. So I found the following in the Logs that can help me allow the Java application.

 

Let's continue with the next steps.

 

How to Edit WDAC Policy

We are ready to edit the WDAC Policy, deploy it again and verify that it's working as expected.

• Open the Windows Defender App Control Wizard and click Launch.
• Click on Policy Editor

 

• Select the XML file of the WDAC Policy that we created. Click next

 

 

• Leave the Policy Rules as it and the Audit Mode as well. Click next

 

• Click Add Custom.

 

• The Rule Scope should be in UserMode
• The Rule Action -- Allow
• For the Rule Type select Path. Check the Folder.
• Click Browse and find the Folder Path.

 

• For our scenario, the folder path is 'C:\Program Files (x86)\Java'

 

• Click Next to create the files for the WDAC Policy.
• Copy the new file .p7b and replace it with the UNC location that we are using in GPO.
• Select a PC or Server to which the WDAC Policy is applied and run the gpupdate /force.
• After the PC or Server restarted open the Java and check the Logs to see if you will get again the previous error.
• If not that means the WDAC Policy applied.

 

This is a very basic article about the WDAC and how to start using it.

I hope to help you understand how to use WDAC in your environment.