mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 14:23:38 +00:00
several metadata changes
This commit is contained in:
@ -2,12 +2,15 @@
|
||||
title: Audit Windows Defender Application Control (WDAC) policies (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
@ -94,4 +97,4 @@ Use the following procedure after you have been running a computer with a WDAC p
|
||||
You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](#merge-windows-defender-application-control-policies).
|
||||
|
||||
> [!Note]
|
||||
> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
|
||||
> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Create a code signing cert for Windows Defender Application Control (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/28/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Create an initial default policy (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,14 @@
|
||||
title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10)
|
||||
description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
|
||||
ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Deploy catalog files to support Windows Defender Application Control (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/28/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/28/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
author: dansimp
|
||||
ms.date: 05/17/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Disable Windows Defender Application Control policies (Windows 10)
|
||||
description: This topic covers how to disable unsigned or signed WDAC policies.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,14 @@
|
||||
title: Document your application control management processes (Windows 10)
|
||||
description: This planning topic describes the WDAC policy maintenance information to record for your design document.
|
||||
ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
@ -59,4 +62,4 @@ Every WDAC policy is created with audit mode enabled. After you have successfull
|
||||
|
||||
` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin`
|
||||
|
||||
Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). You can also use other client management software to deploy and manage the policy.
|
||||
Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). You can also use other client management software to deploy and manage the policy.
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Manage packaged apps with Windows Defender Application Control (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/14/2019
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Merge Windows Defender Application Control (WDAC) policies (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 04/09/2019
|
||||
---
|
||||
|
||||
|
@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/21/2018
|
||||
---
|
||||
|
||||
|
@ -6,8 +6,8 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: mdsakibMSFT
|
||||
ms.author: justinha
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.date: 12/06/2018
|
||||
---
|
||||
|
||||
|
@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 04/20/2018
|
||||
---
|
||||
|
||||
|
@ -6,7 +6,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/21/2018
|
||||
---
|
||||
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Understand Windows Defender Application Control policy design decisions (Windows 10)
|
||||
description: Understand Windows Defender Application Control policy design decisions.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/08/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Use code signing to simplify application control for classic Windows applications (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
@ -59,4 +62,4 @@ When you generate a WDAC policy, you are generating a binary-encoded XML documen
|
||||
|
||||
We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command.
|
||||
|
||||
When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy.
|
||||
When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy.
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 02/19/2019
|
||||
---
|
||||
|
||||
@ -37,4 +40,4 @@ Before you get started, be sure to review these best practices:
|
||||
4. After the files are uploaded, click **Sign** to sign the code integrity policy.
|
||||
5. Click **Download** to download the signed code integrity policy.
|
||||
|
||||
When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again.
|
||||
When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again.
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10)
|
||||
description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Windows Defender Application Control and .NET Hardening (Windows 10)
|
||||
description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: morganbr
|
||||
author: dansimp
|
||||
ms.date: 08/20/2018
|
||||
---
|
||||
|
||||
|
@ -4,7 +4,7 @@ description: Automatically authorize applications that Microsoft’s ISG recogni
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: mdsakibMSFT
|
||||
author: dansimp
|
||||
ms.date: 06/14/2018
|
||||
---
|
||||
|
||||
@ -94,4 +94,4 @@ Modern apps are not supported with the ISG heuristic and will need to be separat
|
||||
|
||||
The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run.
|
||||
|
||||
In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases.
|
||||
In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases.
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: mdsakibMSFT
|
||||
author: dansimp
|
||||
ms.date: 06/13/2018
|
||||
---
|
||||
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/16/2018
|
||||
---
|
||||
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
@ -32,4 +32,4 @@ This guide covers design and planning for Windows Defender Application Control (
|
||||
| [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |
|
||||
|
||||
After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
|
||||
|
||||
|
||||
|
@ -2,12 +2,15 @@
|
||||
title: Windows Defender Application Control (WDAC) (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 01/08/2019
|
||||
---
|
||||
|
||||
|
@ -5,7 +5,7 @@ keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: jsuther1974
|
||||
author: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
|
Reference in New Issue
Block a user