deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 13:53:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Change section order for clarity

Browse Source
This commit is contained in:
isbrahm
2020-01-29 14:51:13 -08:00
committed by GitHub
parent ea671956fd
commit 1296c885f1
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
View File

@ -93,7 +93,12 @@ Although either AppLocker or WDAC can be used to control application execution o
- You are using application control to help users avoid running unapproved software, but you do not require a solution designed as a security feature. - You are using application control to help users avoid running unapproved software, but you do not require a solution designed as a security feature.
- You do not wish to enforce application control on application files such as DLLs or drivers. - You do not wish to enforce application control on application files such as DLLs or drivers.
### Detailed Comparison Chart ## When to use both WDAC and AppLocker together
AppLocker can also be deployed as a complement to WDAC to add user- or group-specific rules for shared device scenarios where its important to prevent some users from running specific apps.
As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
## WDAC and AppLocker Feature Availability
| Capability | WDAC | AppLocker | | Capability | WDAC | AppLocker |
|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Platform support | Available on Windows 10 devices | Available on Windows 8+ devices | | Platform support | Available on Windows 10 devices | Available on Windows 8+ devices |
@ -110,11 +115,6 @@ Although either AppLocker or WDAC can be used to control application execution o
| Packaged app rules | [Available on 1903+](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control) | Available on Windows 8+ | | Packaged app rules | [Available on 1903+](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control) | Available on Windows 8+ |
| Enforceable file extensions | <ul><li>Driver files: .sys</li><li>Executable files: .exe and .com</li><li>DLLs: .dll and .ocx</li><li>Windows Installer files: .msi, mst, and .msp</li><li>Scripts: .ps1, .vbs, and .js</li><li>Packaged apps and packaged app installers: .appx</li></ul>Driver files and executables cannot be separately configured.<br>Manages system driver files.<br>Does not manage .bat or .cmd files. | <ul><li>Executable files: .exe and .com</li><li>DLLs: .dll and .ocx</li><li>Windows Installer files: .msi, mst, and .msp</li><li>Scripts: .ps1, .bat, .cmd, .vbs, and .js</li><li>Packaged apps and packaged app installers: .appx</li></ul>Driver files and executables can be separately configured.<br>Does not manage system drivers.<br>Manages .bat and .cmd files. | | Enforceable file extensions | <ul><li>Driver files: .sys</li><li>Executable files: .exe and .com</li><li>DLLs: .dll and .ocx</li><li>Windows Installer files: .msi, mst, and .msp</li><li>Scripts: .ps1, .vbs, and .js</li><li>Packaged apps and packaged app installers: .appx</li></ul>Driver files and executables cannot be separately configured.<br>Manages system driver files.<br>Does not manage .bat or .cmd files. | <ul><li>Executable files: .exe and .com</li><li>DLLs: .dll and .ocx</li><li>Windows Installer files: .msi, mst, and .msp</li><li>Scripts: .ps1, .bat, .cmd, .vbs, and .js</li><li>Packaged apps and packaged app installers: .appx</li></ul>Driver files and executables can be separately configured.<br>Does not manage system drivers.<br>Manages .bat and .cmd files. |
## When to use both WDAC and AppLocker together
AppLocker can also be deployed as a complement to WDAC to add user- or group-specific rules for shared device scenarios where its important to prevent some users from running specific apps.
As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
## See also ## See also
- [WDAC design guide](windows-defender-application-control-design-guide.md) - [WDAC design guide](windows-defender-application-control-design-guide.md)