diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index c952c0c184..68a3ab2dcd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jsuther1974 -ms.date: 05/16/2019 +author: mdsakibMSFT +ms.date: 05/17/2019 --- # Allow COM object registration in a Windows Defender Application Control policy @@ -32,7 +32,7 @@ Get GUID of application to allow in one of the following ways: - Finding block event in Event Viewer (Application and Service Logs > Microsoft > Windows > AppLocker > MSI and Script) and extracting GUID - Creating audit policy (using New-CIPolicy –Audit), potentially with specific provider, and use info from block events to get GUID -### Author setting +### Author policy setting to allow or deny COM object GUID Three elements: - Provider: platform on which code is running (values are Powershell, WSH, IE, VBA, MSI, or a wildcard “AllHostIds”) @@ -46,21 +46,32 @@ One attribute: ### Examples +Example 1: Allows registration of all COM object GUIDs in any provider + ```xml - - - true - - - - - false - - - - - true - - + + + true + + +``` + +Example 2: Blocks a specific COM object from being registered via Internet Explorer (IE) + +```xml + + + false + + + +Example 3: Allows a specific COM object to register in PowerShell + +```xml + + + true + + ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md index 29db07a119..105f6a46bb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jsuther1974 -ms.date: 05/14/2019 +author: mdsakibMSFT +ms.date: 05/17/2019 --- # Create Windows Defender Application Control path-based rules diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index adc318d407..6df51f6694 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jsuther1974 -ms.date: 05/10/2019 +author: mdsakibMSFT +ms.date: 05/17/2019 --- # Deploy multiple Windows Defender Application Control Policies @@ -44,19 +44,22 @@ Note that multiple policies will not work on pre-1903 systems. ### Allow Multiple Policies In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in New-CIPolicy results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. + ```powershell New-CIPolicy -MultiplePolicyFormat -foo –bar ``` Optionally, you can choose to make the new base policy supplementable (allow supplemental policies). + ```powershell Set-RuleOption -FilePath Enabled:Allow Supplemental Policies ``` For signed base policies that are being made supplementable, you need to ensure that supplemental signers are defined. Use the "Supplemental" switch in Add-SignerRule to provide supplemental signers. - ```powershell - Add-SignerRule -FilePath -CertificatePath [-Kernel] [-User] [-Update] [-Supplemental] [-Deny] [] - ``` + +```powershell +Add-SignerRule -FilePath -CertificatePath [-Kernel] [-User] [-Update] [-Supplemental] [-Deny] [] +``` ### Supplemental Policy Creation diff --git a/windows/security/threat-protection/windows-defender-application-control/sideloading-win32-apps-on-windows-10-s-mode-devices.md b/windows/security/threat-protection/windows-defender-application-control/sideloading-win32-apps-on-windows-10-s-mode-devices.md index 5bbde4033e..25dc3efe37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/sideloading-win32-apps-on-windows-10-s-mode-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/sideloading-win32-apps-on-windows-10-s-mode-devices.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jsuther1974 -ms.date: 05/06/2018 +author: mdsakibMSFT +ms.date: 05/17/2018 --- # Sideloading Win32 apps on Windows 10 S mode devices @@ -51,24 +51,37 @@ To allow Win32 apps to run on a Windows 10 device in S mode, admins must ‘unlo ## Creating and Signing a Supplemental Policy 1. Create new base policy using [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) + ```powershell New-CIPolicy -Level PcaCertificate -UserPEs -ScanPath -MultiplePolicyFormat 3> -FilePath ``` + 2. Change it to a supplemental policy using [Set-CIPolicyIdInfo](https://docs.microsoft.com/powershell/module/configci/set-cipolicyidinfo?view=win10-ps) + ```powershell Set-CIPolicyIdInfo -BasePolicyToSupplementPath -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath ``` - Note: ‘5951A96A-E0B5-4D3D-8FB8-3E5B61030784' is the S-mode Base Policy ID. + + >[!NOTE] + >‘5951A96A-E0B5-4D3D-8FB8-3E5B61030784' is the S-mode Base Policy ID. + 3. Put policy in enforce mode using [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps) + ```powershell Set-RuleOption -FilePath -Option 3 –Delete ``` + This deletes the ‘audit mode’ qualifier. + 4. Convert to .bin using [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) + ```powershell ConvertFrom-CIPolicy -XmlFilePath -BinaryFilePath ``` - Note: PolicyID can be found by inspecting the Supplemental Policy XML. Convert to .bin to sign with DGSS (recommended) or .cip to sign locally. + + >[!NOTE] + >PolicyID can be found by inspecting the Supplemental Policy XML. Convert to .bin to sign with DGSS (recommended) or .cip to sign locally. + 5. To sign using the recommended DGSS option through the Microsoft Store for Business, click **Manage** > **Settings** > **Devices** > **Upload** > **Sign**. To sign locally using signtool, see [Signing policies with signtool](signing-policies-with-signtool.md). @@ -76,14 +89,18 @@ To allow Win32 apps to run on a Windows 10 device in S mode, admins must ‘unlo An admin must generate an app catalog for every deployed app: 1. Use Package Inspector to [create a catalog](https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy#a-href-idcreate-catalog-filesacreate-catalog-files-for-your-unsigned-app) - Start Package Inspector to scan the installer: + ```console PackageInspector.exe start C: -path ``` + - Open the app installer. - Stop Package Inspector: + ```console PackageInspector.exe stop C: -Name -cdfpath ``` + 2. To sign using the recommended DGSS option through the Microsoft Store for Business, click **Manage** > **Settings** > **Devices** > **Upload** > **Sign**. To sign locally using signtool, see [Signing policies with signtool](signing-policies-with-signtool.md).