From 56880704635c287a2f39bccdb201af0fc2cd298c Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Thu, 6 Apr 2023 11:24:42 -0700 Subject: [PATCH] Update known-issues.md --- .../operations/known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md index 93e8612489..2fe109537e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md @@ -55,7 +55,7 @@ When the WDAC engine evaluates files against the active set of policies on the d 3. WDAC then checks for the [Managed Installer extended attribute (EA)](configure-authorized-apps-deployed-with-a-managed-installer.md) or the [Intelligent Security Graph (ISG) EA](use-windows-defender-application-control-with-intelligent-security-graph.md) on the file. If either EA exists and the policy enables the corresponding option, then the file is allowed. -4. Lastly, WDAC makes a cloud call to the ISG to get reputation on file, if the policy enables the ISG option. +4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. 5. If no rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly.