deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 03:43:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'main' of github.com:MicrosoftDocs/windows-docs-pr into pm-20230726-security-book

Browse Source
This commit is contained in:
Paolo Matarazzo
2023-07-26 18:08:51 +02:00
parent 34a631d36a 1f50da988b
commit 1e9621a3ab
14 changed files with 14254 additions and 14196 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md
View File

@ -14,11 +14,11 @@ The EA set on the NI file only applies to the currently active WDAC policies. If
In some cases, if an NI file is blocked, you may see a "false positive" block event in the *CodeIntegrity - Operational* event log as described in [WDAC Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues#net-native-images-may-generate-false-positive-block-events).
To mitigate any performance impact caused when the WDAC EA isn't valid or missing, use any of the following strategies:
To mitigate any performance impact caused when the WDAC EA isn't valid or missing:
1. Work with the app developer to pre-compile their NI and digitally sign it. Then, ensure your WDAC policies allow that signature;
2. Run *ngen.exe update* to force .NET to regenerate all NI files immediately after applying changes to your WDAC policies;
3. [Create and sign a catalog file](/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control) for the native images
- Avoid updating the WDAC policies often.
- Run `ngen update` (on all machine architectures) to force .NET to regenerate all NI files immediately after applying changes to your WDAC policies.
- Migrate applications to .NET Core (.NET 6 or greater).
## WDAC and .NET hardening