mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
Update wording in App Control for Business deployment guide
This commit is contained in:
Vinay Pamnani (from Dev Box)
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploying App Control for Business policies
|
||||
description: Learn how to plan and implement a App Control deployment.
|
||||
description: Learn how to plan and implement an App Control deployment.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 01/23/2023
|
||||
ms.topic: overview
|
||||
|
||||
@ -12,14 +12,14 @@ ms.topic: conceptual
|
||||
|
||||
Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your App Control policy but should be included.
|
||||
|
||||
While a App Control policy is running in audit mode, any binary that runs but would have been denied is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. Script and MSI are logged in the **Applications and Services Logs\\Microsoft\\Windows\\AppLocker\\MSI and Script** event log. These events can be used to generate a new App Control policy that can be merged with the original Base policy or deployed as a separate Supplemental policy, if allowed.
|
||||
While an App Control policy is running in audit mode, any binary that runs but would have been denied is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. Script and MSI are logged in the **Applications and Services Logs\\Microsoft\\Windows\\AppLocker\\MSI and Script** event log. These events can be used to generate a new App Control policy that can be merged with the original Base policy or deployed as a separate Supplemental policy, if allowed.
|
||||
|
||||
## Overview of the process to create App Control policy to allow apps using audit events
|
||||
|
||||
> [!Note]
|
||||
> You must have already deployed a App Control audit mode policy to use this process. If you have not already done so, see [Deploying App Control for Business policies](appcontrol-deployment-guide.md).
|
||||
> You must have already deployed an App Control audit mode policy to use this process. If you have not already done so, see [Deploying App Control for Business policies](appcontrol-deployment-guide.md).
|
||||
|
||||
To familiarize yourself with creating App Control rules from audit events, follow these steps on a device with a App Control audit mode policy.
|
||||
To familiarize yourself with creating App Control rules from audit events, follow these steps on a device with an App Control audit mode policy.
|
||||
|
||||
1. Install and run an application not allowed by the App Control policy but that you want to allow.
|
||||
|
||||
@ -28,7 +28,7 @@ To familiarize yourself with creating App Control rules from audit events, follo
|
||||
**Figure 1. Exceptions to the deployed App Control policy**
|
||||
|
||||
|
||||
3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a App Control policy for fully managed devices](../design/create-appcontrol-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**.
|
||||
3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create an App Control policy for fully managed devices](../design/create-appcontrol-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**.
|
||||
|
||||
```powershell
|
||||
$PolicyName= "Lamna_FullyManagedClients_Audit"
|
||||
|
||||
@ -20,11 +20,11 @@ Single-policy format App Control for Business policies (pre-1903 policy schema)
|
||||
> [!IMPORTANT]
|
||||
> Group Policy-based deployment of App Control for Business policies only supports single-policy format App Control policies. To use App Control on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment.
|
||||
|
||||
You should now have a App Control policy converted into binary form. If not, follow the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md).
|
||||
You should now have an App Control policy converted into binary form. If not, follow the steps described in [Deploying App Control for Business policies](appcontrol-deployment-guide.md).
|
||||
|
||||
The following procedure walks you through how to deploy a App Control policy called **SiPolicy.p7b** to a test OU called *App Control Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
The following procedure walks you through how to deploy an App Control policy called **SiPolicy.p7b** to a test OU called *App Control Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
|
||||
To deploy and manage a App Control for Business policy with Group Policy:
|
||||
To deploy and manage an App Control for Business policy with Group Policy:
|
||||
|
||||
1. On a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC**
|
||||
|
||||
|
||||
@ -24,11 +24,11 @@ Configuration Manager includes native support for App Control, which allows you
|
||||
|
||||
Configuration Manager doesn't remove policies once deployed. To stop enforcement, you should switch the policy to audit mode, which will produce the same effect. If you want to disable App Control for Business altogether (including audit mode), you can deploy a script to delete the policy file from disk, and either trigger a reboot or wait for the next reboot.
|
||||
|
||||
### Create a App Control Policy in Configuration Manager
|
||||
### Create an App Control Policy in Configuration Manager
|
||||
|
||||
1. Select **Asset and Compliance** > **Endpoint Protection** > **App Control for Business** > **Create Application Control Policy**
|
||||
|
||||
|
||||
|
||||
|
||||
2. Enter the name of the policy > **Next**
|
||||
3. Enable **Enforce a restart of devices so that this policy can be enforced for all processes**
|
||||
@ -39,7 +39,7 @@ Configuration Manager doesn't remove policies once deployed. To stop enforcement
|
||||
|
||||
6. Select **Add** to begin creating rules for trusted software
|
||||
|
||||
|
||||
|
||||
|
||||
7. Select **File** or **Folder** to create a path rule > **Browse**
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy catalog files to support App Control for Business
|
||||
description: Catalog files simplify running unsigned applications in the presence of a App Control for Business policy.
|
||||
description: Catalog files simplify running unsigned applications in the presence of an App Control for Business policy.
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: how-to
|
||||
ms.date: 11/30/2022
|
||||
@ -14,7 +14,7 @@ ms.date: 11/30/2022
|
||||
|
||||
You need to [obtain a code signing certificate for your own use](use-code-signing-for-better-control-and-protection.md#obtain-code-signing-certificates-for-your-own-use) and use it to sign the catalog file. Then, distribute the signed catalog file using your preferred content deployment mechanism.
|
||||
|
||||
Finally, add a signer rule to your App Control policy for your signing certificate. Then, any apps covered by your signed catalog files are able to run, even if the apps were previously unsigned. With this foundation, you can more easily build a App Control policy that blocks all unsigned code, because most malware is unsigned.
|
||||
Finally, add a signer rule to your App Control policy for your signing certificate. Then, any apps covered by your signed catalog files are able to run, even if the apps were previously unsigned. With this foundation, you can more easily build an App Control policy that blocks all unsigned code, because most malware is unsigned.
|
||||
|
||||
## Create catalog files using Package Inspector
|
||||
|
||||
@ -300,7 +300,7 @@ At the time of the next software inventory cycle, when the targeted clients rece
|
||||
|
||||
## Allow apps signed by your catalog signing certificate in your App Control policy
|
||||
|
||||
Now that you have your signed catalog file, you can add a signer rule to your policy that allows anything signed with that certificate. If you haven't yet created a App Control policy, see the [App Control for Business design guide](../design/appcontrol-design-guide.md).
|
||||
Now that you have your signed catalog file, you can add a signer rule to your policy that allows anything signed with that certificate. If you haven't yet created an App Control policy, see the [App Control for Business design guide](../design/appcontrol-design-guide.md).
|
||||
|
||||
On a computer where the signed catalog file has been deployed, you can use [New-CiPolicyRule](/powershell/module/configci/new-cipolicyrule) to create a signer rule from any file included in that catalog. Then use [Merge-CiPolicy](/powershell/module/configci/merge-cipolicy) to add the rule to your policy XML. Be sure to replace the path values in the following sample:
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ To make a policy effectively inactive before removing it, you can first replace
|
||||
1. Replace the policy rules with "Allow *" rules;
|
||||
2. Set option **3 Enabled:Audit Mode** to change the policy to audit mode only;
|
||||
3. Set option **11 Disabled:Script Enforcement**;
|
||||
4. Allow all COM objects. See [Allow COM object registration in a App Control policy](../design/allow-com-object-registration-in-appcontrol-policy.md#examples);
|
||||
4. Allow all COM objects. See [Allow COM object registration in an App Control policy](../design/allow-com-object-registration-in-appcontrol-policy.md#examples);
|
||||
5. If applicable, remove option **0 Enabled:UMCI** to convert the policy to kernel mode only.
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -54,7 +54,7 @@ You can use a Mobile Device Management (MDM) solution, like Microsoft Intune, to
|
||||
|
||||
<!-- Waiting for information from Intune team on specific steps...
|
||||
|
||||
The steps to use Intune's custom OMA-URI functionality to remove a App Control policy are:
|
||||
The steps to use Intune's custom OMA-URI functionality to remove an App Control policy are:
|
||||
|
||||
1. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
@ -141,7 +141,7 @@ mountvol $MountPoint /D
|
||||
|
||||
## Remove App Control policies causing boot stop failures
|
||||
|
||||
A App Control policy that blocks boot critical drivers can cause a boot stop failure (BSOD) to occur, though this can be mitigated by setting option **10 Enabled:Boot Audit On Failure** in your policies. Additionally, signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. For this reason, signed App Control policies are intentionally more difficult to remove than unsigned policies even for administrators. Tampering with or removing a signed App Control policy will cause a BSOD to occur.
|
||||
an App Control policy that blocks boot critical drivers can cause a boot stop failure (BSOD) to occur, though this can be mitigated by setting option **10 Enabled:Boot Audit On Failure** in your policies. Additionally, signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. For this reason, signed App Control policies are intentionally more difficult to remove than unsigned policies even for administrators. Tampering with or removing a signed App Control policy will cause a BSOD to occur.
|
||||
|
||||
To remove a policy that is causing boot stop failures:
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enforce App Control for Business policies
|
||||
description: Learn how to switch a App Control policy from audit to enforced mode.
|
||||
description: Learn how to switch an App Control policy from audit to enforced mode.
|
||||
ms.manager: jsuther
|
||||
ms.date: 04/22/2021
|
||||
ms.topic: how-to
|
||||
|
||||
@ -29,7 +29,7 @@ To learn how to create and manage catalog files for existing apps, see [Deploy c
|
||||
|
||||
## Signed App Control policies
|
||||
|
||||
While a App Control policy begins as an XML document, it's then converted into a binary-encoded file before deployment. This binary version of your policy can be code signed like any other application binary, offering many of the same benefits as described above for signed code. Additionally, signed policies are treated specially by App Control and help protect against tampering or removal of a policy even by an admin user.
|
||||
While an App Control policy begins as an XML document, it's then converted into a binary-encoded file before deployment. This binary version of your policy can be code signed like any other application binary, offering many of the same benefits as described above for signed code. Additionally, signed policies are treated specially by App Control and help protect against tampering or removal of a policy even by an admin user.
|
||||
|
||||
For more information on using signed policies, see [Use signed policies to protect App Control for Business against tampering](use-signed-policies-to-protect-appcontrol-against-tampering.md)
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ Before you attempt to deploy a signed policy, you should first deploy an unsigne
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> This example uses an enforced version of the App Control policy that you created in [Create a App Control for Business policy from a reference computer](../design/create-appcontrol-policy-using-reference-computer.md) article. If you sign another policy, be sure to update the **$PolicyPath** and **$PolicyName** variables with the correct information.
|
||||
> This example uses an enforced version of the App Control policy that you created in [Create an App Control for Business policy from a reference computer](../design/create-appcontrol-policy-using-reference-computer.md) article. If you sign another policy, be sure to update the **$PolicyPath** and **$PolicyName** variables with the correct information.
|
||||
|
||||
2. Navigate to your desktop as the working directory:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user