From 6f7622f6325ceab931112f0d0fe12aba481b4eb5 Mon Sep 17 00:00:00 2001 From: Bella Brahm Date: Thu, 24 Oct 2019 16:04:17 -0700 Subject: [PATCH 1/3] Change author on allow-COM-objects Update to reflect proper WDAC feature owners author: jsuther1974 ms.reviewer: brbrahm ms.author: dansimp manager: dansimp --- ...ion-in-windows-defender-application-control-policy.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index c33eca6f6f..6d7275e35a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -1,12 +1,19 @@ --- title: Allow COM object registration in a Windows Defender Application Control policy (Windows 10) description: You can allow COM object registration in a Windows Defender Application Control policy. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/21/2019 --- From df427631a3706fcd2faffb0cb6607a62079915bc Mon Sep 17 00:00:00 2001 From: Bella Brahm Date: Thu, 24 Oct 2019 16:17:47 -0700 Subject: [PATCH 2/3] Update WDAC metadata Updating WDAC docs metadata to reflect current ownership author: jsuther1974 ms.reviewer: brbrahm ms.author: dansimp manager: dansimp --- ...windows-defender-application-control-policies.md | 8 +++++++- ...cert-for-windows-defender-application-control.md | 6 ++++++ .../create-initial-default-policy.md | 6 ++++++ .../create-path-based-rules.md | 9 ++++++++- ...efender-application-control-planning-document.md | 10 ++++++---- ...-support-windows-defender-application-control.md | 6 ++++++ ...windows-defender-application-control-policies.md | 9 ++++++++- ...plication-control-policies-using-group-policy.md | 6 ++++++ ...der-application-control-policies-using-intune.md | 8 +++++++- ...windows-defender-application-control-policies.md | 6 ++++++ ...nder-application-control-management-processes.md | 9 ++++++--- ...windows-defender-application-control-policies.md | 8 +++++++- ...pps-with-windows-defender-application-control.md | 6 ++++++ ...windows-defender-application-control-policies.md | 6 ++++++ .../microsoft-recommended-block-rules.md | 9 +++++++++ ...ndows-defender-application-control-management.md | 7 +++++++ ...ntrol-events-centrally-using-advanced-hunting.md | 12 +++++++++--- .../select-types-of-rules-to-create.md | 7 +++++++ .../signing-policies-with-signtool.md | 7 +++++++ .../types-of-devices.md | 12 ++++++++---- ...r-application-control-policy-design-decisions.md | 6 ++++++ ...tion-control-for-classic-windows-applications.md | 8 +++++++- ...igning-portal-in-microsoft-store-for-business.md | 8 +++++++- ...efender-application-control-against-tampering.md | 6 ++++++ ...control-specific-plug-ins-add-ins-and-modules.md | 6 ++++++ ...pplication-control-with-dynamic-code-security.md | 8 +++++++- ...ation-control-with-intelligent-security-graph.md | 13 +++++++++++-- ...er-application-control-with-managed-installer.md | 12 ++++++++++-- ...defender-application-control-deployment-guide.md | 10 +++++++++- ...ows-defender-application-control-design-guide.md | 13 +++++++++---- .../windows-defender-application-control.md | 6 ++++++ .../windows-defender-device-guard-and-applocker.md | 10 +++++++++- 32 files changed, 231 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 740a8eab56..4fea4faf75 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -1,13 +1,19 @@ --- title: Audit Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- @@ -94,4 +100,4 @@ Use the following procedure after you have been running a computer with a WDAC p You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](#merge-windows-defender-application-control-policies). > [!Note] -> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies. \ No newline at end of file +> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index 54c89364d5..967c859f17 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -1,13 +1,19 @@ --- title: Create a code signing cert for Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md index b5d1cd4483..beae82240d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -1,13 +1,19 @@ --- title: Create an initial default policy (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md index 105f6a46bb..f2af3b06c6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md @@ -1,12 +1,19 @@ --- title: Windows Defender Application Control path-based rules (Windows 10) description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md index f204088397..e1c566f4bf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md @@ -1,17 +1,19 @@ --- title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document. -ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 09/21/2017 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index b6683d45c4..210235d8e7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -1,13 +1,19 @@ --- title: Deploy catalog files to support Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 6df51f6694..c8cd66b8c9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -1,12 +1,19 @@ --- title: Deploy multiple Windows Defender Application Control Policies (Windows 10) description: Windows Defender Application Control supports multiple code integrity policies for one device. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index 46f8a8a3c8..601c4eedde 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -1,13 +1,19 @@ --- title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 857ab2ea09..3845fb7d3f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -1,13 +1,19 @@ --- title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md index 188693edf8..67115aca79 100644 --- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md @@ -1,13 +1,19 @@ --- title: Disable Windows Defender Application Control policies (Windows 10) description: This topic covers how to disable unsigned or signed WDAC policies. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md index a414320068..f7aa789f5d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md +++ b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md @@ -1,16 +1,19 @@ --- title: Document your application control management processes (Windows 10) description: This planning topic describes the WDAC policy maintenance information to record for your design document. -ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -manager: dansimp audience: ITPro ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.topic: conceptual ms.date: 09/21/2017 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 3315c79715..a0b4e7235b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -1,13 +1,19 @@ --- title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- @@ -59,4 +65,4 @@ Every WDAC policy is created with audit mode enabled. After you have successfull ` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` -Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). You can also use other client management software to deploy and manage the policy. \ No newline at end of file +Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). You can also use other client management software to deploy and manage the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md index d1d521cfb4..eeb1c43054 100644 --- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md @@ -1,13 +1,19 @@ --- title: Manage packaged apps with Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/14/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md index 8e2c628037..bbc690e61e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -1,13 +1,19 @@ --- title: Merge Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 34fbe7530e..4fe66b4c96 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -2,10 +2,19 @@ title: Microsoft recommended block rules (Windows 10) description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Comntrol, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 04/09/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index de4380bc34..385daa5129 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -1,12 +1,19 @@ --- title: Plan for Windows Defender Application Control policy management (Windows 10) description: Plan for Windows Defender Application Control policy management. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/21/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md index af40ccb8a4..0e989f1c6e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md +++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md @@ -1,13 +1,19 @@ --- title: Querying Application Control events centrally using Advanced hunting (Windows 10) description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT -ms.author: justinha +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 12/06/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 342163da92..eff4c952f2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -1,12 +1,19 @@ --- title: Select the types of rules to create (Windows 10) description: Select the types of rules to create. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 04/20/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md index 40b5506097..83e05407ff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md +++ b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md @@ -1,12 +1,19 @@ --- title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10) description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/21/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md index 2edd777efc..8a86d231a0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md @@ -1,15 +1,19 @@ --- title: types of devices (Windows 10) description: Typically, deployment of Windows Defender Application Control happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: justinha -manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 03/01/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md index 94c511c911..b2f96cd551 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md @@ -1,13 +1,19 @@ --- title: Understand Windows Defender Application Control policy design decisions (Windows 10) description: Understand Windows Defender Application Control policy design decisions. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/08/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md index 4b6482ac05..2ac23e8d49 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -1,13 +1,19 @@ --- title: Use code signing to simplify application control for classic Windows applications (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- @@ -59,4 +65,4 @@ When you generate a WDAC policy, you are generating a binary-encoded XML documen We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command. -When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy. \ No newline at end of file +When the WDAC policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index d50f975bc2..46bd9725ba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -1,13 +1,19 @@ --- title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/19/2019 --- @@ -37,4 +43,4 @@ Before you get started, be sure to review these best practices: 4. After the files are uploaded, click **Sign** to sign the code integrity policy. 5. Click **Download** to download the signed code integrity policy. - When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again. \ No newline at end of file + When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index 27aca349ba..0bea29a60a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -1,13 +1,19 @@ --- title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10) description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md index 5e919a7437..22ba2596bd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md @@ -1,13 +1,19 @@ --- title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md index f126a1d3f3..b7b361af4e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md @@ -1,13 +1,19 @@ --- title: Windows Defender Application Control and .NET Hardening (Windows 10) description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: morganbr +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 08/20/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index fb6831f17b..d1d3135384 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -1,10 +1,19 @@ --- title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10) description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 06/14/2018 --- @@ -94,4 +103,4 @@ Modern apps are not supported with the ISG heuristic and will need to be separat The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. -In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. \ No newline at end of file +In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index 43d842fa8e..0943cabd7e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -1,11 +1,19 @@ --- title: Deploy Managed Installer for Windows Defender Device Guard (Windows 10) description: Explains how you can use a managed installer to automatically authorize applications deployed and installed by a designated software distribution solution, such as System Center Configuration Manager. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 06/13/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index 0ebbc19cc4..fbaa6391b4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -1,11 +1,19 @@ --- title: Planning and getting started on the Windows Defender Application Control deployment process (Windows 10) description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/16/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index 7fa8248d7c..62c4c60457 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -1,14 +1,19 @@ --- title: Windows Defender Application Control design guide (Windows 10) description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: justinha -manager: dansimp audience: ITPro ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.topic: conceptual ms.date: 02/20/2018 --- @@ -32,4 +37,4 @@ This guide covers design and planning for Windows Defender Application Control ( | [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |   After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. -  \ No newline at end of file +  diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index b5c590602d..7349a02135 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -1,13 +1,19 @@ --- title: Windows Defender Application Control (WDAC) (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 01/08/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md index 61c656fc0d..c42fafe412 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md @@ -1,11 +1,19 @@ --- title: Windows Defender Device Guard and AppLocker (Windows 10) description: Explains how -keywords: virtualization, security, malware +keywords: virtualization, whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- From 26064136b46560e70f9e5012d543847cc49f53ce Mon Sep 17 00:00:00 2001 From: Bella Brahm Date: Thu, 24 Oct 2019 16:22:52 -0700 Subject: [PATCH 3/3] Update WDAC multiple policies Give better example powershell command --- ...ultiple-windows-defender-application-control-policies.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index c8cd66b8c9..65ccd117ca 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -50,16 +50,16 @@ Note that multiple policies will not work on pre-1903 systems. ### Allow Multiple Policies -In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in New-CIPolicy results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. +In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format. ```powershell -New-CIPolicy -MultiplePolicyFormat -foo –bar +New-CIPolicy -MultiplePolicyFormat -ScanPath '.\temp\' -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash ``` Optionally, you can choose to make the new base policy supplementable (allow supplemental policies). ```powershell -Set-RuleOption -FilePath Enabled:Allow Supplemental Policies +Set-RuleOption -FilePath -Option 17 ``` For signed base policies that are being made supplementable, you need to ensure that supplemental signers are defined. Use the "Supplemental" switch in Add-SignerRule to provide supplemental signers.