From 78878545f4b505b1d2394abc4b6da18fd3404463 Mon Sep 17 00:00:00 2001
From: yogesh thangjam <53617154+TJ2215@users.noreply.github.com>
Date: Sun, 28 Feb 2021 04:06:53 -0600
Subject: [PATCH] Update
allow-com-object-registration-in-windows-defender-application-control-policy.md
---
...ows-defender-application-control-policy.md | 51 +++++++++++++++++++
1 file changed, 51 insertions(+)
diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
index 1a451b7545..0719946e8e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
@@ -92,4 +92,55 @@ Example 3: Allows a specific COM object to register in PowerShell
```
+### How to configure the settings for the CLSIDs
+For example, you get an error in the Event Viewer (Application and Service Logs > Microsoft > Windows > AppLocker > MSI and Script) like below:
+
+Log Name: Microsoft-Windows-AppLocker/MSI and Script
+Source: Microsoft-Windows-AppLocker
+Date: 11/11/2020 1:18:11 PM
+Event ID: 8036
+Task Category: None
+Level: Error
+Keywords:
+User: S-1-5-21-3340858017-3068726007-3466559902-3647
+Computer: contoso.com
+Description:
+{f8d253d9-89a4-4daa-87b6-1168369f0b21} was prevented from running due to Config CI policy.
+Event Xml:
+
+
+
+ 8036
+ 0
+ 2
+ 0
+ 0
+ 0x4000000000000000
+
+ 819347
+
+
+ Microsoft-Windows-AppLocker/MSI and Script
+ contoso.com
+
+
+
+ false
+ {f8d253d9-89a4-4daa-87b6-1168369f0b21}
+
+
+
+To add this CLSID to the existing policy, follow the steps below,
+1. Open the Powershell ISE with administrative priviledge.
+2. Now from the admin powershell ISE, type this command and run it. Considering the name of the policy is WDAC_policy.xml .
+PS C:\WINDOWS\system32> Set-CIPolicySetting -FilePath \WDAC_policy.xml -Key 8856f961-340a-11d0-a96b-00c04fd705a2 -Provider WSH -Value True -ValueName EnterpriseDefinedClsId -ValueType Boolean
+
+Once the command is run, you will find that the following section is added to the policy xml.
+
+
+
+
+ true
+
+