deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-21 05:13:40 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updated instances of MEMCM to Configuration Manager and click to select

Browse Source
This commit is contained in:
Jordan Geurten
2022-06-29 15:08:14 -04:00
parent 77f87dcca4
commit 882d3050b3
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md
View File

@ -29,7 +29,7 @@ ms.localizationpriority: medium
You can use Microsoft Endpoint Configuration Manager to configure Windows Defender Application Control (WDAC) on client machines. You can use Microsoft Endpoint Configuration Manager to configure Windows Defender Application Control (WDAC) on client machines.
## Use MEMCM's built-in policies ## Use Configuration Manager's built-in policies
Microsoft Endpoint Configuration Manager includes native support for WDAC, which allows you to configure Windows 10 and Windows 11 client computers with a policy that will only allow: Microsoft Endpoint Configuration Manager includes native support for WDAC, which allows you to configure Windows 10 and Windows 11 client computers with a policy that will only allow:
@ -41,22 +41,22 @@ Microsoft Endpoint Configuration Manager includes native support for WDAC, which
Note that Configuration Manager does not remove policies once deployed. To stop enforcement, you should switch the policy to audit mode, which will produce the same effect. If you want to disable Windows Defender Application Control (WDAC) altogether (including audit mode), you can deploy a script to delete the policy file from disk, and either trigger a reboot or wait for the next reboot. Note that Configuration Manager does not remove policies once deployed. To stop enforcement, you should switch the policy to audit mode, which will produce the same effect. If you want to disable Windows Defender Application Control (WDAC) altogether (including audit mode), you can deploy a script to delete the policy file from disk, and either trigger a reboot or wait for the next reboot.
### Create a WDAC Policy in MEMCM ### Create a WDAC Policy in Configuration Manager
1. Select **Asset and Compliance** > **Endpoint Protection** > **Windows Defender Application Control** > **Create Application Control Policy** 1. Select **Asset and Compliance** > **Endpoint Protection** > **Windows Defender Application Control** > **Create Application Control Policy**
![Create a WDAC policy in MEMCM.](../images/memcm/memcm-create-wdac-policy.jpg) ![Create a WDAC policy in Configuration Manager.](../images/memcm/memcm-create-wdac-policy.jpg)
2. Enter the name of the policy > **Next** 2. Enter the name of the policy > **Next**
3. Enable **Enforce a restart of devices so that this policy can be enforced for all processes** 3. Enable **Enforce a restart of devices so that this policy can be enforced for all processes**
4. Select the mode which you want the policy to run (Enforcement enabled / Audit Only) 4. Select the mode which you want the policy to run (Enforcement enabled / Audit Only)
5. Click **Next** 5. Click **Next**
![Create an enforced WDAC policy in MEMCM.](../images/memcm/memcm-create-wdac-policy-2.jpg) ![Create an enforced WDAC policy in Configuration Manager.](../images/memcm/memcm-create-wdac-policy-2.jpg)
6. Click **Add** to begin creating rules for trusted software 6. Select **Add** to begin creating rules for trusted software
![Create a WDAC path rule in MEMCM.](../images/memcm/memcm-create-wdac-rule.jpg) ![Create a WDAC path rule in Configuration Manager.](../images/memcm/memcm-create-wdac-rule.jpg)
7. Select **File** or **Folder** to create a path rule > **Browse** 7. Select **File** or **Folder** to create a path rule > **Browse**
@ -69,13 +69,13 @@ Note that Configuration Manager does not remove policies once deployed. To stop
9. Select **OK** to add the rule to the table of trusted files or folder 9. Select **OK** to add the rule to the table of trusted files or folder
10. Select **Next** to navigate to the summary page > **Close** 10. Select **Next** to navigate to the summary page > **Close**
![Confirm the WDAC path rule in MEMCM.](../images/memcm/memcm-confirm-wdac-rule.jpg) ![Confirm the WDAC path rule in Configuration Manager.](../images/memcm/memcm-confirm-wdac-rule.jpg)
### Deploy the WDAC Policy in MEMCM ### Deploy the WDAC Policy in Configuration Manager
1. Right-click the newly created policy > **Deploy Application Control Policy** 1. Right-click the newly created policy > **Deploy Application Control Policy**
![Deploy WDAC via MEMCM.](../images/memcm/memcm-deploy-wdac.jpg) ![Deploy WDAC via Configuration Manager.](../images/memcm/memcm-deploy-wdac.jpg)
2. Select **Browse** 2. Select **Browse**
@ -91,7 +91,7 @@ Note that Configuration Manager does not remove policies once deployed. To stop
For more information on using Configuration Manager's native WDAC policies, see [Windows Defender Application Control management with Configuration Manager](/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager). For more information on using Configuration Manager's native WDAC policies, see [Windows Defender Application Control management with Configuration Manager](/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager).
The entire WDAC in MEMCM Lab Paper is available for download [here](../pdfs/WDAC-Deploy-WDAC-using-MEMCM.pdf). The entire WDAC in Configuration Manager Lab Paper is available for download [here](/pdfs/WDAC-Deploy-WDAC-using-MEMCM.pdf).
## Deploy custom WDAC policies using Packages/Programs or Task Sequences ## Deploy custom WDAC policies using Packages/Programs or Task Sequences