diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index 445b6fb85e..db4bf85899 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -64,7 +64,7 @@ Based on the above, Alice defines the pseudo-rules for the policy: 2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function 3. **Allow Managed Installer** (MEMCM and *LamnaITInstaller.exe* configured as a managed installer) -The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md#Define-the-"circle-of-trust"-for-lightly-managed-devices) are: +The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices#Define-the-"circle-of-trust"-for-lightly-managed-devices) are: - Removal of the Intelligent Security Graph (ISG) option; and - Removal of filepath rules. @@ -150,7 +150,7 @@ Alice has defined a policy for Lamna's fully-managed devices that makes some tra Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. - **Managed installer**
- See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer.md#Security-considerations-with-managed-installer) + See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer#Security-considerations-with-managed-installer) Existing mitigations applied: - Limit who can elevate to administrator on the device. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md index a0aef66202..e6b6d9ad54 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md @@ -156,13 +156,13 @@ In order to minimize user productivity impact, Alice has defined a policy that m - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. - Limit who can elevate to administrator on the device. - **Managed installer**
- See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer.md#Security-considerations-with-managed-installer) + See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer#Security-considerations-with-managed-installer) Possible mitigations: - Create and deploy signed catalog files as part of the app deployment process in order to remove the requirement for managed installer. - Limit who can elevate to administrator on the device. - **Intelligent Security Graph (ISG)**
- See [security considerations with the Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md#Security-considerations-with-the-Intelligent-Security-Graph) + See [security considerations with the Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph#Security-considerations-with-the-Intelligent-Security-Graph) Possible mitigations: - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature based rules. @@ -174,7 +174,7 @@ In order to minimize user productivity impact, Alice has defined a policy that m - Use signed WDAC policies which allow authorized signed supplemental policies only. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - **FilePath rules**
- See [more information about filepath rules](select-types-of-rules-to-create.md#More-information-about-filepath-rules) + See [more information about filepath rules](select-types-of-rules-to-create#More-information-about-filepath-rules) Possible mitigations: - Limit who can elevate to administrator on the device.