From 61149771d21407e0591221acf12c171e6f0b3b64 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 14:11:14 +0530 Subject: [PATCH 1/6] TASK 5358645: Windows 11 Inclusion Update -01 TASK 5358645: First batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria). --- .../LOB-win32-apps-on-s.md | 11 +++-- ...ows-defender-application-control-policy.md | 13 +++--- ...s-defender-application-control-policies.md | 10 +++-- ...s-defender-application-control-policies.md | 10 +++-- ...-apps-deployed-with-a-managed-installer.md | 10 +++-- .../configure-wdac-managed-installer.md | 12 ++++-- ...or-windows-defender-application-control.md | 10 +++-- .../create-initial-default-policy.md | 30 +++++++------ ...e-wdac-policy-for-fully-managed-devices.md | 40 ++++++++++-------- ...wdac-policy-for-lightly-managed-devices.md | 42 ++++++++++--------- ...rt-windows-defender-application-control.md | 8 +++- ...s-defender-application-control-policies.md | 10 +++-- ...ion-control-policies-using-group-policy.md | 14 ++++--- ...plication-control-policies-using-intune.md | 13 ++++-- ...s-defender-application-control-policies.md | 8 +++- ...s-defender-application-control-policies.md | 12 ++++-- .../example-wdac-base-policies.md | 10 +++-- .../feature-availability.md | 12 ++++-- ...th-windows-defender-application-control.md | 8 +++- ...s-defender-application-control-policies.md | 12 ++++-- .../microsoft-recommended-block-rules.md | 16 ++++--- ...icrosoft-recommended-driver-block-rules.md | 12 ++++-- ...defender-application-control-management.md | 14 ++++--- .../select-types-of-rules-to-create.md | 18 ++++---- .../types-of-devices.md | 16 ++++--- 25 files changed, 236 insertions(+), 135 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 311cfd2625..af1e30dca2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -1,5 +1,5 @@ --- -title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows 10) +title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows) description: Using WDAC supplemental policies, you can expand the S mode base policy on your Intune-managed devices. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,10 +23,15 @@ ms.technology: mde **Applies to:** - Windows 10 +- Windows 11 +- Windows Server 2016 and above -Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization". +Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications and Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. + +With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization". Refer to the below video for an overview and brief demo. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp] diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index 4b3eb396a8..107430388b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -1,5 +1,5 @@ --- -title: Allow COM object registration in a WDAC policy (Windows 10) +title: Allow COM object registration in a WDAC policy (Windows) description: You can allow COM object registration in a Windows Defender Application Control policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,17 +22,20 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 -- Windows Server 2019 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). >[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +>Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The [Microsoft Component Object Model (COM)](/windows/desktop/com/the-component-object-model) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM specifies an object model and programming requirements that enable COM objects to interact with other objects. ### COM object configurability in WDAC policy -Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. +Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. **NOTE**: To add this functionality to other versions of Windows 10, you can install the following or later updates: diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md index c1d7ac7c71..bc1218b82c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use audit events to create then enforce WDAC policy rules (Windows 10) +title: Use audit events to create then enforce WDAC policy rules (Windows) description: Learn how audits allow admins to discover apps, binaries, and scripts that should be added to a WDAC policy, then learn how to switch that WDAC policy from audit to enforced mode. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 5ed5fa1cf7..cb94565bff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use audit events to create WDAC policy rules (Windows 10) +title: Use audit events to create WDAC policy rules (Windows) description: Audits allow admins to discover apps, binaries, and scripts that should be added to the WDAC policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included. diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 15639fd8d3..76eb273ded 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -1,5 +1,5 @@ --- -title: Configure authorized apps deployed with a WDAC-managed installer (Windows 10) +title: Configure authorized apps deployed with a WDAC-managed installer (Windows) description: Explains how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2019 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager. diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md index 9d15cbfcc7..14ac17e575 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md @@ -1,5 +1,5 @@ --- -title: Configure a WDAC managed installer (Windows 10) +title: Configure a WDAC managed installer (Windows) description: Explains how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2019 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled. There are three primary steps to keep in mind: @@ -126,7 +130,7 @@ For example: In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy. This can be done by using the [Set-RuleOption cmdlet](/powershell/module/configci/set-ruleoption) with Option 13. -Below are steps to create a WDAC policy which allows Windows to boot and enables the managed installer option. +Below are steps to create a WDAC policy that allows Windows to boot and enables the managed installer option. 1. Copy the DefaultWindows_Audit policy into your working folder from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index f3b993cbc0..b9ca84a296 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -1,5 +1,5 @@ --- -title: Create a code signing cert for Windows Defender Application Control (Windows 10) +title: Create a code signing cert for Windows Defender Application Control (Windows) description: Learn how to set up a publicly-issued code signing certificate, so you can sign catalog files or WDAC policies internally. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md). @@ -75,7 +79,7 @@ When this certificate template has been created, you must publish it to the CA p 2. Select the WDAC Catalog signing certificate, and then click **OK**. -Now that the template is available to be issued, you must request one from the computer running Windows 10 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: +Now that the template is available to be issued, you must request one from the computer running Windows 10 and Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: 1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md index a4d560af0b..40ab4ad3bd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows 10) +title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows) description: To create a Windows Defender Application Control (WDAC) policy for fixed-workload devices within your organization, follow this guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,30 +22,34 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc... +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -For this example, you must initiate variables to be used during the creation process or use the full file paths in the command. -Then create the WDAC policy by scanning the system for installed applications. +This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc. + +For this example, you must initiate variables to be used during the creation process or use the full file paths in the command. +Then create the WDAC policy by scanning the system for installed applications. The policy file is converted to binary format when it gets created so that Windows can interpret it. ## Overview of the process of creating Windows Defender Application Control policies A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md). -Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. +Optionally, WDAC can align with your software catalog and any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged, or serviced, and managed. -If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). +If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). > [!NOTE] -> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy. +> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy. -Each installed software application should be validated as trustworthy before you create a policy. -We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable. -Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts. -You can remove or disable such software on the reference computer. +Each installed software application should be validated as trustworthy before you create a policy. +We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable. +Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts. +You can remove or disable such software on the reference computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index cceb8da77d..3870af3447 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for fully-managed devices (Windows 10) +title: Create a WDAC policy for fully managed devices (Windows) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. keywords: security, malware ms.topic: conceptual @@ -19,29 +19,33 @@ ms.date: 11/20/2019 ms.technology: mde --- -# Create a WDAC policy for fully-managed devices +# Create a WDAC policy for fully managed devices **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for **fully-managed devices** within an organization. The key difference between this scenario and [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully-managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully-managed devices should ideally run as standard user and only authorized IT pros have administrative access. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +This section outlines the process to create a WDAC policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access. > [!NOTE] -> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. As described in [common WDAC deployment scenarios](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. **Alice Pena** is the IT team lead tasked with the rollout of WDAC. -Alice previously created a policy for the organization's lightly-managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and task-workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT. +Alice previously created a policy for the organization's lightly managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and firstline workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT. -## Define the "circle-of-trust" for fully-managed devices +## Define the "circle-of-trust" for fully managed devices -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully-managed devices: +Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully managed devices: -- All clients are running Windows 10 version 1903 or above; +- All clients are running Windows 10 version 1903 or above or Windows 11; - All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune; > [!NOTE] @@ -55,15 +59,15 @@ Alice's team develops a simple console application, called *LamnaITInstaller.exe Based on the above, Alice defines the pseudo-rules for the policy: -1. **“Windows works”** rules which authorizes: +1. **“Windows works”** rules that authorize: - Windows - WHQL (3rd party kernel drivers) - Windows Store signed apps -2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function +2. **"MEMCM works”** rules that include signer and hash rules for MEMCM components to properly function 3. **Allow Managed Installer** (MEMCM and *LamnaITInstaller.exe* configured as a managed installer) -The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: +The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: - Removal of the Intelligent Security Graph (ISG) option; and - Removal of filepath rules. @@ -77,7 +81,7 @@ Alice follows these steps to complete this task: > [!NOTE] > If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy. -1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above. +1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above, or Windows 11. 2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables: @@ -129,12 +133,12 @@ Alice follows these steps to complete this task: At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna. -## Security considerations of this fully-managed policy +## Security considerations of this fully managed policy -Alice has defined a policy for Lamna's fully-managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include: +Alice has defined a policy for Lamna's fully managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include: - **Users with administrative access**
- Although applying to fewer users, Lamna still allows some IT staff to log in to its fully-managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish. + Although applying to fewer users, Lamna still allows some IT staff to log in to its fully managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish. Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. @@ -160,7 +164,7 @@ Alice has defined a policy for Lamna's fully-managed devices that makes some tra Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction. Possible mitigations: - - Use signed WDAC policies which allow authorized signed supplemental policies only. + - Use signed WDAC policies that allow authorized signed supplemental policies only. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. ## Up next diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md index c4dabcde4c..76199f55b5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for lightly-managed devices (Windows 10) +title: Create a WDAC policy for lightly managed devices (Windows) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. keywords: security, malware ms.topic: conceptual @@ -19,29 +19,33 @@ ms.date: 11/15/2019 ms.technology: mde --- -# Create a WDAC policy for lightly-managed devices +# Create a WDAC policy for lightly managed devices **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for **lightly-managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC managed devices as described in later topics. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +This section outlines the process to create a WDAC policy for **lightly managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC-managed devices as described in later topics. > [!NOTE] -> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. As in the [previous topic](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. -**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with very loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads. +**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads. For the majority of users and devices, Alice wants to create an initial policy that is as relaxed as possible in order to minimize user productivity impact, while still providing security value. -## Define the "circle-of-trust" for lightly-managed devices +## Define the "circle-of-trust" for lightly managed devices -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly-managed devices, which currently includes most end-user devices: +Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly managed devices, which currently include most end-user devices: -- All clients are running Windows 10 version 1903 or above; +- All clients are running Windows 10 version 1903 and above, or Windows 11; - All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune; > [!NOTE] @@ -53,12 +57,12 @@ Alice identifies the following key factors to arrive at the "circle-of-trust" fo Based on the above, Alice defines the pseudo-rules for the policy: -1. **“Windows works”** rules which authorizes: +1. **“Windows works”** rules that authorize: - Windows - WHQL (3rd party kernel drivers) - Windows Store signed apps -2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function +2. **"MEMCM works”** rules which include signer and hash rules for MEMCM components to properly function 3. **Allow Managed Installer** (MEMCM configured as a managed installer) 4. **Allow Intelligent Security Graph (ISG)** (reputation-based authorization) 5. **Admin-only path rules** for the following locations: @@ -68,14 +72,14 @@ Based on the above, Alice defines the pseudo-rules for the policy: ## Create a custom base policy using an example WDAC base policy -Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly-managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs. +Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs. Alice follows these steps to complete this task: > [!NOTE] > If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy. -1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above. +1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 and above, or Windows 11. 2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables: @@ -137,12 +141,12 @@ Alice follows these steps to complete this task: At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna. -## Security considerations of this lightly-managed policy +## Security considerations of this lightly managed policy In order to minimize user productivity impact, Alice has defined a policy that makes several trade-offs between security and user app flexibility. Some of the trade-offs include: - **Users with administrative access**
- By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish. + By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish. Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. @@ -164,13 +168,13 @@ In order to minimize user productivity impact, Alice has defined a policy that m See [security considerations with the Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md#security-considerations-with-the-intelligent-security-graph) Possible mitigations: - - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature based rules. + - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature-based rules. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - **Supplemental policies**
Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction. Possible mitigations: - - Use signed WDAC policies which allow authorized signed supplemental policies only. + - Use signed WDAC policies that allow authorized signed supplemental policies only. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - **FilePath rules**
See [more information about filepath rules](select-types-of-rules-to-create.md#more-information-about-filepath-rules) @@ -181,5 +185,5 @@ In order to minimize user productivity impact, Alice has defined a policy that m ## Up next -- [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md) +- [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) - [Prepare to deploy WDAC policies](windows-defender-application-control-deployment-guide.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 2a3d5a91f3..52cac752d2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -1,5 +1,5 @@ --- -title: Deploy catalog files to support Windows Defender Application Control (Windows 10) +title: Deploy catalog files to support Windows Defender Application Control (Windows) description: Catalog files simplify running unsigned applications in the presence of a Windows Defender Application Control (WDAC) policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Catalog files can be important in your deployment of Windows Defender Application Control (WDAC) if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create WDAC policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by WDAC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 33cc699ac1..9ea7cc663a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use multiple Windows Defender Application Control Policies (Windows 10) +title: Use multiple Windows Defender Application Control Policies (Windows) description: Windows Defender Application Control supports multiple code integrity policies for one device. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 version 1903 and above -- Windows Server 2022 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Prior to Windows 10 1903, WDAC only supported a single active policy on a system at any given time. This significantly limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios: diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index 8e8fa29002..d20e96958f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -1,5 +1,5 @@ --- -title: Deploy WDAC policies via Group Policy (Windows 10) +title: Deploy WDAC policies via Group Policy (Windows) description: Windows Defender Application Control (WDAC) policies can easily be deployed and managed with Group Policy. Learn how by following this step-by-step guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,11 +22,15 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). > [!NOTE] -> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, we recommend using an alternative method for policy deployment. +> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment. Single-policy format WDAC policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy. The following procedure walks you through how to deploy a WDAC policy called **ContosoPolicy.bin** to a test OU called *WDAC Enabled PCs* by using a GPO called **Contoso GPO Test**. @@ -61,4 +65,4 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. -7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the WDAC policy. +7. Close the Group Policy Management Editor, and then restart the Windows test computer. Restarting the computer updates the WDAC policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 8cf09e5b2f..250600e081 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -1,5 +1,5 @@ --- -title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows 10) +title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows) description: You can use an MDM like Microsoft Intune to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,13 +22,18 @@ ms.technology: mde **Applies to:** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). You can use a Mobile Device Management (MDM) solution, like Microsoft Endpoint Manager (MEM) Intune, to configure Windows Defender Application Control (WDAC) on client machines. Intune includes native support for WDAC which can be a helpful starting point, but customers may find the available circle-of-trust options too limiting. To deploy a custom policy through Intune and define your own circle of trust, you can configure a profile using Custom OMA-URI. If your organization uses another MDM solution, check with your solution provider for WDAC policy deployment steps. ## Use Intune's built-in policies -Intune's built-in WDAC support allows you to configure Windows 10 client computers to only run: +Intune's built-in WDAC support allows you to configure Windows client computers to only run: - Windows components - 3rd party hardware and software kernel drivers @@ -36,7 +41,7 @@ Intune's built-in WDAC support allows you to configure Windows 10 client compute - [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) > [!NOTE] -> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ as described later in this topic. +> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. > [!NOTE] > Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP will always request a reboot when applying WDAC policies. You can use Intune's custom OMA-URI feature with the ApplicationControl CSP to deploy your own WDAC policies rebootlessly. diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md index 6cbf4d90fa..ad706276ac 100644 --- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Disable Windows Defender Application Control policies (Windows 10) +title: Disable Windows Defender Application Control policies (Windows) description: Learn how to disable both signed and unsigned Windows Defender Application Control policies, within Windows and within the BIOS. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic covers how to disable unsigned or signed WDAC policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 6c3b04eb5a..5dd1fd73f9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10) +title: Enforce Windows Defender Application Control (WDAC) policies (Windows) description: Learn how to switch a WDAC policy from audit to enforced mode. keywords: security, malware ms.prod: m365-security @@ -20,13 +20,17 @@ ms.localizationpriority: medium **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). You should now have one or more WDAC policies broadly deployed in audit mode. You have analyzed events collected from the devices with those policies and you're ready to enforce. Use this procedure to prepare and deploy your WDAC policies in enforcement mode. > [!NOTE] -> Some of the steps described in this article only apply to Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the steps described in this article only apply to Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs. ## Convert WDAC **base** policy from audit to enforced diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md index 8457a3a69c..4e249a4f50 100644 --- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md @@ -1,5 +1,5 @@ --- -title: Example Windows Defender Application Control (WDAC) base policies (Windows 10) +title: Example Windows Defender Application Control (WDAC) base policies (Windows) description: When creating a WDAC policy for an organization, start from one of the many available example base policies. keywords: security, malware ms.topic: article @@ -23,8 +23,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). When creating policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that can be used, or organizations that use the Device Guard Signing Service can download a starter policy from that service. diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md index 0f9af0978c..16eb1e9257 100644 --- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md +++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md @@ -23,16 +23,20 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). | Capability | WDAC | AppLocker | |-------------|------|-------------| -| Platform support | Available on Windows 10 | Available on Windows 8+ | +| Platform support | Available on Windows 10 and Windows 11 | Available on Windows 8+ | | SKU availability | Cmdlets are available on all SKUs on 1909+ builds.
For pre-1909 builds, cmdlets are only available on Enterprise but policies are effective on all SKUs. | Policies deployed through GP are only effective on Enterprise devices.
Policies deployed through MDM are effective on all SKUs. | | Management solutions | |