mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Merge pull request #1435 from isbrahm/master
WDAC correct links + remove misinformation
This commit is contained in:
@ -117,16 +117,7 @@ Value type is char.
|
||||
To use ApplicationControl CSP, you must:
|
||||
- Know a generated policy’s GUID, which can be found in the policy xml as `<PolicyTypeID>`.
|
||||
- Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned.
|
||||
- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool.
|
||||
|
||||
Here is a sample certutil invocation:
|
||||
```
|
||||
certutil -encode WinSiPolicy.p7b WinSiPolicy.cer
|
||||
```
|
||||
An alternative to using certutil would be to use the following PowerShell invocation:
|
||||
```
|
||||
[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path <bin file>))
|
||||
```
|
||||
If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI
|
||||
functionality to apply the Code Integrity policy.
|
||||
|
||||
|
@ -36,11 +36,11 @@ Before you get started, be sure to review these best practices:
|
||||
**Best practices**
|
||||
|
||||
- Test your code integrity policies on a pilot group of devices before deploying them to production.
|
||||
- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](hhttps://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
|
||||
- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
|
||||
|
||||
**To sign a code integrity policy**
|
||||
|
||||
1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, click **Store settings**, and then click **Device Guard**.
|
||||
3. Click **Upload** to upload your code integrity policy.
|
||||
4. After the files are uploaded, click **Sign** to sign the code integrity policy.
|
||||
|
Reference in New Issue
Block a user