deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 10:53:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Fix blocking issues

Browse Source
This commit is contained in:
Vinay Pamnani (from Dev Box)
2024-09-27 09:17:08 -06:00
parent 565fe6d980
commit 28be109a18
3 changed files with 7 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies.md
View File

@ -52,24 +52,6 @@ Then restart the computer.
You can use a Mobile Device Management (MDM) solution, like Microsoft Intune, to remove App Control policies from client machines using the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp).
<!-- Waiting for information from Intune team on specific steps...
The steps to use Intune's custom OMA-URI functionality to remove an App Control policy are:
1. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10).
2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings:
- **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_PolicyId GUID_/Policy`
- **Data type**: Base64 (file)
- **Certificate file**: upload your binary format policy file. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf.
> [!div class="mx-imgBorder"]
> ![Configure custom App Control.](../images/appcontrol-intune-custom-oma-uri.png)
> [!NOTE]
> For the _Policy GUID_ value, do not include the curly brackets.
-->
Consult your MDM solution provider for specific information on using the ApplicationControl CSP.
Then restart the computer.
@ -141,7 +123,7 @@ mountvol $MountPoint /D
## Remove App Control policies causing boot stop failures
an App Control policy that blocks boot critical drivers can cause a boot stop failure (BSOD) to occur, though this can be mitigated by setting option **10 Enabled:Boot Audit On Failure** in your policies. Additionally, signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. For this reason, signed App Control policies are intentionally more difficult to remove than unsigned policies even for administrators. Tampering with or removing a signed App Control policy will cause a BSOD to occur.
An App Control policy that blocks boot critical drivers can cause a boot stop failure (BSOD) to occur, though this can be mitigated by setting option **10 Enabled:Boot Audit On Failure** in your policies. Additionally, signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. For this reason, signed App Control policies are intentionally more difficult to remove than unsigned policies even for administrators. Tampering with or removing a signed App Control policy will cause a BSOD to occur.
To remove a policy that is causing boot stop failures:

13
windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-editing-policy.md
View File

@ -11,11 +11,10 @@ ms.date: 09/11/2024
[!INCLUDE [Feature availability note](../includes/feature-availability-note.md)]
The App Control for Business Wizard makes editing and viewing App Control policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
<ul>
<li><a href="#configuring-policy-rules">Configuring policy rules</a></li>
<li><a href="#adding-file-rules">Adding new allow or block file rules to existing policies</a></li>
<li><a href="#removing-file-rules">Removing allow or block file rules on existing policies</a></li>
</ul>
- Configuring policy rules
- Adding new allow or block file rules to existing policies
- Removing allow or block file rules on existing policies
## Configuring Policy Rules
@ -48,11 +47,9 @@ The App Control Wizard makes deleting file rules from an existing policy quick a
<FileAttribRef RuleID="ID_FILEATTRIB_LOB_APP_2" />
```
[comment]: <> (## Editing File Rules Coming soon!)
### Policy Creation
Once the policy is created, the new policy will be written to the same path as the in-edit policy. The new policy file name will have the policy version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml.
Once the policy is created, the new policy will be written to the same path as the in-edit policy. The new policy file name will have the policy version appended to the end of the file name. For instance, if the in-edit policy is saved at `MyDocuments\BasePolicy.xml`, after edit, the new policy will be saved at `MyDocuments\BasePolicy_v10.0.0.1.xml`.
## Up next

2
windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard.md
View File

@ -14,7 +14,7 @@ The App Control for Business policy wizard is an open-source Windows desktop app
## Downloading the application
Download the tool from the official [App Control for Business Policy Wizard website](https://webapp-wdac-wizard.azurewebsites.net/) as an MSIX packaged application. The tool's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [App Control for Business Policy Wizard repository](https://github.com/MicrosoftDocs/App Control-Toolkit).
Download the tool from the official [App Control for Business Policy Wizard website](https://webapp-wdac-wizard.azurewebsites.net/) as an MSIX packaged application. The tool's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [App Control for Business Policy Wizard repository](https://github.com/MicrosoftDocs/WDAC-Toolkit).
### Supported clients