diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index aed91aa7a0..20831a816f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -1,6 +1,7 @@ --- title: Audit Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- @@ -96,5 +102,5 @@ Use the following procedure after you have been running a computer with a WDAC p You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md). -> [!NOTE] -> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies. +> [!Note] +> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index 92c3c3aa47..52d5d95647 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -1,6 +1,7 @@ --- title: Create a code signing cert for Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md index 67c1e0ccef..80502547f2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -1,6 +1,7 @@ --- title: Create an initial default policy (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md index 44a9846b76..f5bb41fc40 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md @@ -1,13 +1,19 @@ --- title: Windows Defender Application Control path-based rules (Windows 10) description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT -ms.author: mdsakib +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md index d7f2a132fb..09c1315422 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md @@ -1,19 +1,19 @@ --- title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document. -ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e -ms.reviewer: -ms.author: dansimp +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 09/21/2017 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 13fa578687..a0b5479b91 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -1,16 +1,19 @@ --- title: Deploy catalog files to support Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 97eea2439c..ac32b57390 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -1,13 +1,19 @@ --- title: Deploy multiple Windows Defender Application Control Policies (Windows 10) description: Windows Defender Application Control supports multiple code integrity policies for one device. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: mdsakibMSFT -ms.author: mdsakib +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index e4c776c47e..22ea7b222c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -1,16 +1,19 @@ --- title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/28/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 61a3e06b58..03921c380e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -1,16 +1,19 @@ --- title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/17/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md index 79cdfd3512..914ea84187 100644 --- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md @@ -1,16 +1,19 @@ --- title: Disable Windows Defender Application Control policies (Windows 10) description: This topic covers how to disable unsigned or signed WDAC policies. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md index f29188cd79..692278772f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md +++ b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md @@ -1,18 +1,19 @@ --- title: Document your application control management processes (Windows 10) description: This planning topic describes the WDAC policy maintenance information to record for your design document. -ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb -ms.reviewer: -ms.author: dansimp +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp audience: ITPro ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.topic: conceptual ms.date: 09/21/2017 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 13a60fe360..8e3742d802 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -1,16 +1,19 @@ --- title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md index fbad450704..5ec4473345 100644 --- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md @@ -1,16 +1,19 @@ --- title: Manage packaged apps with Windows Defender Application Control (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/14/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md index 4d04e9f6fa..f29ba398bf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -1,16 +1,19 @@ --- title: Merge Windows Defender Application Control (WDAC) policies (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 387ba074e2..dba43ea768 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -1,16 +1,20 @@ --- title: Microsoft recommended block rules (Windows 10) description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp audience: ITPro -ms.date: 04/09/2019 -ms.reviewer: -manager: dansimp +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 04/09/2019 --- # Microsoft recommended block rules diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index be74ddf1f0..385daa5129 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -1,16 +1,20 @@ --- title: Plan for Windows Defender Application Control policy management (Windows 10) description: Plan for Windows Defender Application Control policy management. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 02/21/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 02/21/2018 --- # Plan for Windows Defender Application Control policy management diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md index fa2f7af6ec..0e989f1c6e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md +++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md @@ -1,16 +1,20 @@ --- title: Querying Application Control events centrally using Advanced hunting (Windows 10) description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp -ms.date: 12/06/2018 -ms.reviewer: manager: dansimp +ms.date: 12/06/2018 --- # Querying Application Control events centrally using Advanced hunting diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 287c247293..153465c8df 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -1,16 +1,20 @@ --- title: Select the types of rules to create (Windows 10) description: Select the types of rules to create. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 04/20/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 04/20/2018 --- # Deploy Windows Defender Application Control policy rules and file rules diff --git a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md index 7f2c0b16d3..8c2d524fbb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md +++ b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md @@ -1,16 +1,20 @@ --- title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10) description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 02/21/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 02/21/2018 --- # Signing Windows Defender Application Control policies with SignTool.exe diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md index aacc7afb09..8a86d231a0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md @@ -1,18 +1,20 @@ --- title: types of devices (Windows 10) description: Typically, deployment of Windows Defender Application Control happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 03/01/2018 -ms.reviewer: +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 03/01/2018 --- # Windows Defender Application Control deployment in different scenarios: types of devices diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md index 5f6b6c7849..d73468d703 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md @@ -1,6 +1,7 @@ --- title: Understand Windows Defender Application Control policy design decisions (Windows 10) description: Understand Windows Defender Application Control policy design decisions. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/08/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md index 597df3c8b3..c5a77d3560 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -1,6 +1,7 @@ --- title: Use code signing to simplify application control for classic Windows applications (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index 567c3db270..f6783c1ecb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -1,6 +1,7 @@ --- title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 02/19/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index 7cca116982..ee98e15eea 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -1,6 +1,7 @@ --- title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10) description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md index 8919d6d670..142d3154f9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md @@ -1,6 +1,7 @@ --- title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp @@ -10,7 +11,12 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 05/03/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md index 8d7885f549..384f767155 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md @@ -1,16 +1,19 @@ --- title: Windows Defender Application Control and .NET Hardening (Windows 10) description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 08/20/2018 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index 91eec3f5c5..515ca61a8e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -1,14 +1,20 @@ --- title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10) description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 06/14/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 06/14/2018 --- # Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph @@ -98,6 +104,9 @@ Modern apps are not supported with the ISG heuristic and will need to be separat The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. +<<<<<<< HEAD >[!NOTE] > A rule that explicitly allows an application will take precedence over the ISG rule that does not allow it. In this scenario, this policy is not compatible with Intune, where there is no option to add rules to the template that enables ISG. In most circumstances you would need to build a custom WDAC policy, including ISG if desired. +======= +>>>>>>> Update WDAC metadata diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index 1c2b670b16..3011af49ff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -1,15 +1,20 @@ --- title: Deploy Managed Installer for Windows Defender Device Guard (Windows 10) description: Explains how you can use a managed installer to automatically authorize applications deployed and installed by a designated software distribution solution, such as System Center Configuration Manager. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 06/13/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 06/13/2018 --- # Deploy Managed Installer for Windows Defender Application Control diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index 38cfd605db..629c35deb5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -1,15 +1,20 @@ --- title: Planning and getting started on the Windows Defender Application Control deployment process (Windows 10) description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 05/16/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 05/16/2018 --- # Planning and getting started on the Windows Defender Application Control deployment process diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index e9719fd4e4..dd6e029e4c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -1,18 +1,21 @@ --- title: Windows Defender Application Control design guide (Windows 10) description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. -keywords: virtualization, security, malware +keywords: whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -manager: dansimp audience: ITPro ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.topic: conceptual ms.date: 02/20/2018 -ms.reviewer: -ms.author: dansimp --- # Windows Defender Application Control design guide @@ -34,4 +37,8 @@ This guide covers design and planning for Windows Defender Application Control ( | [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. | After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. +<<<<<<< HEAD +======= +  +>>>>>>> Update WDAC metadata diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index 3605322e2c..7fcc89b839 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -1,16 +1,19 @@ --- title: Windows Defender Application Control (WDAC) (Windows 10) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm +ms.author: dansimp +manager: dansimp ms.date: 01/08/2019 --- diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md index bc80b871c8..dfb54e5cb5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md @@ -1,15 +1,20 @@ --- title: Windows Defender Device Guard and AppLocker (Windows 10) description: Explains how -keywords: virtualization, security, malware +keywords: virtualization, whitelisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.date: 05/03/2018 -ms.reviewer: -manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: brbrahm ms.author: dansimp +manager: dansimp +ms.date: 05/03/2018 --- # Windows Defender Device Guard with AppLocker