From ef4e99945651c2c8655952b9f7bcc1294eeaf89c Mon Sep 17 00:00:00 2001
From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com>
Date: Tue, 19 Oct 2021 21:56:18 +0500
Subject: [PATCH 1/2] Update
configure-authorized-apps-deployed-with-a-managed-installer.md
---
...-apps-deployed-with-a-managed-installer.md | 42 ++-----------------
1 file changed, 3 insertions(+), 39 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
index 26506a422a..ccdc08e421 100644
--- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
@@ -177,45 +177,9 @@ An example of a valid Managed Installer rule collection, using Microsoft Endpoin
```
-### Enable service enforcement in AppLocker policy
-Since many installation processes rely on services, it is typically necessary to enable tracking of services.
-Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice. The audit rule can be added to the policy created above, which specifies the rule collection of your managed installer.
-
-For example:
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
+>[!NOTE]
+>Since many installation processes rely on services, it is typically necessary to enable tracking of services. Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit-only rule will suffice.
## Enable the managed installer option in WDAC policy
@@ -305,4 +269,4 @@ Once you've completed configuring your chosen Managed Installer, by specifying w
```powershell
Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue
```
- This command will show the raw XML to verify the individual rules that were set.
\ No newline at end of file
+ This command will show the raw XML to verify the individual rules that were set.
From 652ba0f13925e171850bfb508883e3556f610941 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 19 Oct 2021 13:33:51 -0700
Subject: [PATCH 2/2] Update
configure-authorized-apps-deployed-with-a-managed-installer.md
---
...-authorized-apps-deployed-with-a-managed-installer.md | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
index ccdc08e421..b33350aaa1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 08/10/2021
+ms.date: 10/19/2021
ms.technology: mde
---
@@ -26,8 +26,8 @@ ms.technology: mde
- Windows 11
- Windows Server 2016 and above
->[!NOTE]
->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager.
@@ -41,8 +41,7 @@ Ensure that the WDAC policy allows the system/boot components and any other auth
## Security considerations with managed installer
-Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do.
-It's best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager (MEMCM).
+Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do. The managed installer is best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager (MEMCM).
Users with administrator privileges, or malware running as an administrator user on the system, may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed.