diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index baa458ee02..8b2d2e8dff 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -1,5 +1,10 @@
{
"redirections": [
+ {
+ "source_path": "windows/application-management/msix-app-packaging-tool.md",
+ "redirect_url": "/windows/application-management/apps-in-windows-10",
+ "redirect_document_id": false
+ },
{
"source_path": "browsers/edge/about-microsoft-edge.md",
"redirect_url": "/previous-versions/windows/edge-legacy/about-microsoft-edge",
diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md
index 2834995eab..30c4423927 100644
--- a/windows/application-management/add-apps-and-features.md
+++ b/windows/application-management/add-apps-and-features.md
@@ -1,30 +1,74 @@
---
-title: Windows 10 - How to add apps from Apps & features
-description: Learn how to add apps, like XPS Viewer, to your Windows 10 device with the Apps & features page in Settings
+title: Add or hide optional apps and features on Windows devices | Microsoft Docs
+description: Learn how to add Windows 10 and Windows 11 optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features.
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: article
-ms.author: greglin
-author: greg-lindsay
+ms.author: mandia
+author: MandiOhlinger
ms.localizationpriority: medium
-ms.date: 04/26/2018
+ms.date: 08/30/2021
ms.reviewer:
-manager: dansimp
+manager: dougeby
ms.topic: article
---
-# How to add apps and features to Windows 10
-> Applies to: Windows 10
-Windows 10 includes a range of [applications](apps-in-windows-10.md), from [system apps](apps-in-windows-10.md#system-apps) that support the operating system (like Settings) to ["provisioned" apps](apps-in-windows-10.md#provisioned-windows-apps) (like Feedback Hub) that are installed the first time you run Windows. We also provide additional apps and features, called Features on Demand (like language packs or handwriting recognition), that you can install at any time. If you're working in a managed environment (like at work, where you have an administrator who manages your systems and resources), your admin can use [Windows Update to install Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you're working on your own device, you can add apps and features from the Settings app.
+# Add or hide features on the Windows client OS
-Here's how you do that:
+> Applies to:
+>
+> - Windows 10
-1. In the Search bar, search for "apps."
-2. Select **Apps and features** in the results.
-3. Select **Manage optional features**, and then select **Add a feature**.
-4. Select the feature you want to add, like **XPS Viewer**, and then select **Install.**
+The Windows client operating systems include more features that you and your users can install. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (opens another Microsoft web site), and can be installed at any time. On your organization-owned devices, you may want to control access to these other features.
-And that's it. You can see the apps you have installed on the **Apps & features** page and the features on **Manage optional features**.
+This article:
-You can manage and uninstall apps and features from the same Settings page. Just select the app or feature, and then select **Uninstall**.
\ No newline at end of file
+- Shows you how to add features using the user interface.
+- Lists the group policies and Mobile device management (MDM) policies to hide Windows Features.
+- Includes information on using Windows PowerShell to disable specific Windows Features.
+
+If you're working on your own device, use the **Settings** app to add features.
+
+## Add or uninstall features
+
+1. In the Search bar, search for "apps", and select **Apps and features**.
+2. Select **Optional features** > **Add a feature**.
+3. Select the feature you want to add, like **XPS Viewer**, and then select **Install.**
+
+When the installation completes, the feature is listed in **Apps & features**. In **Apps & features** > **Optional features** > **More Windows features**, there are more features that you and your users can install.
+
+To uninstall a feature, open the **Settings** app. Select the feature, and then select **Uninstall**.
+
+## Use Group Policy or MDM to hide Windows Features
+
+By default, the OS might show Windows Features, and allow users to install and uninstall these optional apps and features.
+
+To hide Windows Features on your user devices, you can use Group Policy (on-premises), or use an MDM provider, such as Microsoft Intune (cloud).
+
+### Group Policy
+
+If you use Group Policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the Windows Features is hidden on the device.
+
+You can't use Group Policy to disable specific Windows Features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features) (in this article).
+
+If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy.
+
+### MDM
+
+Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to hide Windows Features.
+
+If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the Control Panel settings you can configure, see [Control Panel settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings).
+
+## Use Windows PowerShell to disable specific features
+
+To disable specific features, you can use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) command. There isn't a Group Policy that disables specific Windows Features.
+
+If you're looking to automate disabling specific features, you can create a scheduled task. Then, use the scheduled task to run your Windows PowerShell script. For more information about Task Scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page).
+
+Microsoft Intune can also execute Windows PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension).
+
+## Restore Windows features
+
+- If you use Group Policy or MDM to hide Windows Features or the entire Apps feature, you can set the policy to **Not configured**. Then, deploy your policy. When the device receives the policy, the features are configurable.
+- Using Windows PowerShell, you can also enable specific features using the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) command.
diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md
index 3d8a9d9f4d..4fc3710369 100644
--- a/windows/application-management/apps-in-windows-10.md
+++ b/windows/application-management/apps-in-windows-10.md
@@ -1,803 +1,148 @@
---
title: Learn about the different app types in Windows 10 | Microsoft Docs
ms.reviewer:
-manager: dansimp
-description: Use this article to understand the different types of apps that run on Windows 10, such as UWP and Win32 apps.
+manager: dougeby
+description: Learn more and understand the different types of apps that run on Windows 10 and Windows 11. For example, learn more about UWP, WPF, Win32, and Windows Forms apps, including the best way to install these apps.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: mobile
-ms.author: greglin
-author: greg-lindsay
+ms.author: mandia
+author: MandiOhlinger
ms.localizationpriority: medium
ms.topic: article
---
-# Understand the different apps included in Windows 10
->Applies to: Windows 10
+# Overview of apps on Windows client devices
-On your Windows 10 devices, you can run the following app types:
+> Applies to:
+>
+> - Windows 10
-- **Windows apps**: These apps are included with the Windows OS, and are also installed from the Microsoft Store app. There are two categories:
+## Before you begin
+
+As organizations become more global, and to support employees working from anywhere, it's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. For Microsoft, that includes using Microsoft Endpoint Manager. Endpoint Manager includes Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises.
+
+In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started:
+
+- [Microsoft Endpoint Manager overview](/mem/endpoint-manager-overview)
+- [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide)
+- [What is Configuration Manager?](/mem/configmgr/core/understand/introduction)
+
+## App types
+
+There are different types of apps that can run on your Windows client devices. This section lists some of the common apps used on Windows devices.
+
+- **Microsoft 365 apps**: These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. Depending on the licenses your organization has, you may already have these apps. Using an MDM provider, these apps can also be deployed to mobile devices, including smartphones.
+
+ For more information on the Microsoft 365 license options, and what you get, see [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans).
+
+- **Power Apps**: These apps connect to business data available online and on-premises, and can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. For more information, see [What is Power Apps?](/powerapps/powerapps-overview).
+
+- **.NET apps**: These apps can be desktop apps that run on the device, or web apps. Some common .NET apps include:
+
+ - **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF Application Development](/dotnet/desktop/wpf/app-development).
+ - **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview).
+
+- **Windows apps**:
+
+ > [!TIP]
+ > Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/).
- **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps:
- - **Provisioned**: Installed in user account the first time you sign in with a new user account.
+ - **Provisioned**: Installed in user account the first time you sign in with a new user account. For a list of some common provisioned apps, see [Provisioned apps installed with the Windows client OS](provisioned-apps-windows-client-os.md).
- **Installed**: Installed as part of the OS.
- - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS.
+ - **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps.
-- **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. But, not all Windows apps are UWP apps.
-- **Win32 apps**: These apps are traditional Windows applications.
+ For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide).
-This article lists the provisioned Windows apps and system apps installed on a standard Windows 10 Enterprise device. If you use custom images, your specific apps might be different.
+ - **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET.
-Some of the apps show up in multiple areas. That's because their status changed between versions. Make sure to check the version column for the version you're currently running.
+ For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Make your apps great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows).
-## Provisioned Windows apps
+ - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. For a list of some common system apps, see [System apps installed with the Windows client OS](system-apps-windows-client-os.md).
-The first time a user signs into a Windows device, some apps are automatically provisioned. To get a list of all provisioned Windows apps, run the following Windows PowerShell command:
+- **Web apps** and **Progressive web apps (PWA)**: These apps run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have internet access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform.
-```Powershell
-Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName
-```
+ Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview).
-The following information lists the provisioned apps on the supported Windows 10 OS versions:
+ Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices.
-- [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | Package name: Microsoft.3DBuilder
- - Supported versions:
+## Add or deploy apps to devices
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ✔️ | ✔️ | | | | | |
+When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options.
- ---
+- **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps** > **Apps and Features**.
-- [Bing Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | Package name: Microsoft.BingWeather
- - Supported versions:
+ If you want to prevent users from downloading apps on organization owned devices, use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10).
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ✔️ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+ For an overview of the different types of device policies you can create, see [Apply features and settings on your devices using device profiles in Microsoft Intune](/mem/intune/configuration/device-profiles).
- ---
+- **Mobile device management (MDM)**: Use an MDM provider, like Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add Store apps, and more.
-- [Desktop App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | Package name: Microsoft.DesktopAppInstaller
- - Supported versions:
+ For more information, see:
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | Use Settings App | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+ - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add)
+ - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management)
- ---
+- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store. And, they can download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **[Windows Package Manager](/windows/package-manager)** to add apps to the private store.
-- [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | Package name: Microsoft.GetHelp
- - Supported versions:
+ To help manage the Microsoft Store on your devices, you can use policies:
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+ - On premises, you can use Administrative Templates in Group Policy to control access to the Microsoft Store app:
+ - `User Configuration\Administrative Templates\Windows Components\Store`
+ - `Computer Configuration\Administrative Templates\Windows Components\Store`
+ - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to control access to the Microsoft Store app.
- ---
+ For more information, see:
-- [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | Package name: Microsoft.Getstarted
- - Supported versions:
+ - [Microsoft Store for Business and Education](/microsoft-store/)
+ - [Evolving the Microsoft Store for Business and Education](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-the-microsoft-store-for-business-and-education/ba-p/2569423)
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+- **MSIX for desktop apps**: MSIX packages your UWP, Win32, WPF, and WinForm desktop application files. MSIX reliably installs apps, helps optimize disk storage space, and reduces duplicate files. If your organization typically uses `.EXE` or `.MSI` files to install desktop apps, then you should look into MSIX.
- ---
+ To deploy MSIX packages and their apps, you can:
-- [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.HEIFImageExtension
- - Supported versions:
+ - Use an MDM provider, like Microsoft Intune and Configuration Manager.
+ - Use an App Installer. User users double-click an installer file, or select a link on a web page.
+ - And more.
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+ For more information, see:
- ---
+ - [What is MSIX?](/windows/msix/overview)
+ - [MSIX app distribution for enterprises](/windows/msix/desktop/managing-your-msix-deployment-enterprise)
-- [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | Package name:Microsoft.Messaging
- - Supported versions:
+- **Windows Package Manager**: Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can get apps from the Microsoft Store or from GitHub (and more), and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers.
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
+ If your organization uses `.EXE`, `.MSIX`, or `.MSI` files, then Windows Package Manager might be the right deployment option for your organization.
- ---
+ For more information, see [Windows Package Manager](/windows/package-manager).
-- [Microsoft 3D Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | Package name: Microsoft.Microsoft3DViewer
- - Supported versions:
+- **Azure Virtual desktop with MSIX app attach**: With Azure virtual desktop, you can virtualize the Windows client OS desktop, and use virtual apps on this desktop. With MSIX app attach, you dynamically deliver MSIX packaged apps to users and user groups.
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+ The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they're installed locally.
- ---
+ If you currently use App-V, and want to reduce your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization.
-- [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftOfficeHub
- - Supported versions:
+ For more information, see:
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+ - [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview)
+ - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal)
- ---
+- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps.
-- [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftSolitaireCollection
- - Supported versions:
+ > [!NOTE]
+ > Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at **Azure Virtual desktop with MSIX app attach**. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal).
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+ On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally.
- ---
+ The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md).
-- [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftStickyNotes
- - Supported versions:
+ To help manage App-V on your devices, you can use policies:
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+ - On premises, you can use Administrative Templates in Group Policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`).
+ - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to deploy App-V policies.
- ---
-
-- [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | Package name: Microsoft.MixedReality.Portal
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | Package name: Microsoft.MSPaint
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | Package name: Microsoft.Office.OneNote
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | Package name: Microsoft.OneConnect
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
-
- ---
-
-- Microsoft.Outlook.DesktopIntegrationServices
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | | ✔️ | ✔️| | ✔️| | |
-
- ---
-
-- [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | Package name: Microsoft.People
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | Package name: Microsoft.Print3D
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
-
- ---
-
-- [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | Package name: Microsoft.ScreenSketch
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | Package name: Microsoft.SkypeApp
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | Package name: Microsoft.StorePurchaseApp
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- Microsoft.VP9VideoExtensions
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | Package name: Microsoft.Wallet
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | Package name: Microsoft.WebMediaExtensions
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.WebpImageExtension
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | Package name: Microsoft.Windows.Photos
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | Package name: Microsoft.WindowsAlarms
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCalculator
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCamera
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | Package name: microsoft.windowscommunicationsapps
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | Package name: Microsoft.WindowsFeedbackHub
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | Package name: Microsoft.WindowsMaps
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | Package name: Microsoft.WindowsSoundRecorder
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | Package name: Microsoft.WindowsStore
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
- - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you can restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it.
-
-- [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | Package name: Microsoft.Xbox.TCUI
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | Package name: Microsoft.XboxApp
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGameOverlay
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGamingOverlay
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | Package name: Microsoft.XboxIdentityProvider
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- Microsoft.XboxSpeechToTextOverlay
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | Package name: Microsoft.YourPhone
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | Package name: Microsoft.ZuneMusic
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-- [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | Package name: Microsoft.ZuneVideo
- - Supported versions:
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
- | --- | --- | --- | --- | --- | --- |--- |
- | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
-
- ---
-
-## System apps
-
-System apps are used by the operating system. To get a list of all the system apps, run the following Windows PowerShell command:
-
-```Powershell
-Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation
-```
-
-The following information lists the system apps on some Windows 10 OS versions:
-
-- File Picker | Package name: 1527c705-839a-4832-9118-54d4Bd6a0c89
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- File Explorer | Package name: c5e2524a-ea46-4f67-841f-6a9465d9d515
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- App Resolver UX | Package name: E2A4F912-2574-4A75-9BB0-0D023378592B
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Add Suggested Folders To Library | Package name: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- InputApp
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | | | ✔️ |
-
- ---
-
-- Microsoft.AAD.Broker.Plugin | Package name: Microsoft.AAD.Broker.Plugin
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.AccountsControl | Package name: Microsoft.AccountsControl
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.AsyncTextService | Package name: Microsoft.AsyncTextService
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Hello setup UI | Package name: Microsoft.BioEnrollment
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.CredDialogHost
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.ECApp
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.LockApp
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft Edge | Package name: Microsoft.MicrosoftEdge
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.MicrosoftEdgeDevToolsClient
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.PPIProjection
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | | | ✔️ |
-
- ---
-
-- Microsoft.Win32WebViewHost
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.Apprep.ChxApp
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.AssignedAccessLockApp
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.CapturePicker
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.CloudExperienceHost
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.ContentDeliveryManager
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Cortana | Package name: Microsoft.Windows.Cortana
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | | | ✔️ |
-
- ---
-
-- Microsoft.Windows.OOBENetworkCaptivePort
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.OOBENetworkConnectionFlow
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.ParentalControls
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- People Hub | Package name: Microsoft.Windows.PeopleExperienceHost
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.PinningConfirmationDialog
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.SecHealthUI
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.Windows.SecureAssessmentBrowser
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Start | Package name: Microsoft.Windows.ShellExperienceHost
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Microsoft.XboxGameCallableUI
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Windows.CBSPreview
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Settings | Package name: Windows.immersivecontrolpanel
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
-
-- Print 3D | Package name: Windows.Print3D
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ✔️ | | | ✔️ |
-
- ---
-
-- Print UI | Package name: Windows.PrintDialog
-
- ---
- | Uninstall through UI? | 21H1 | 20H2 | 1809 |
- | --- | --- | --- | --- |
- | ❌ | ✔️ | ✔️| ✔️ |
-
- ---
diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml
index d3a95df0d0..e6739ae97e 100644
--- a/windows/application-management/index.yml
+++ b/windows/application-management/index.yml
@@ -13,8 +13,8 @@ metadata:
ms.collection: windows-10
author: greg-lindsay #Required; your GitHub user alias, with correct capitalization.
ms.author: greglin #Required; microsoft alias of author; optional team alias.
- ms.date: 04/30/2021 #Required; mm/dd/yyyy format.
- localization_priority: medium
+ ms.date: 08/24/2021 #Required; mm/dd/yyyy format.
+ ms.localizationpriority : medium
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
@@ -26,11 +26,11 @@ landingContent:
linkLists:
- linkListType: overview
links:
- - text: Understand apps in Windows 10
+ - text: Understand apps in Windows client OS
url: apps-in-windows-10.md
- - text: How to add apps and features to Windows 10
+ - text: How to add features
url: add-apps-and-features.md
- - text: Sideload LOB apps in Windows 10
+ - text: Sideload LOB apps
url: sideload-apps-in-windows-10.md
- text: Keep removed apps from returning during an update
url: remove-provisioned-apps-during-update.md
diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md
deleted file mode 100644
index 96e4e52e60..0000000000
--- a/windows/application-management/msix-app-packaging-tool.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Repackage your existing win32 applications to the MSIX format.
-description: Learn how to install and use the MSIX packaging tool to repackage your existing win32 applications to the MSIX format.
-keywords: ["MSIX", "application", "app", "win32", "packaging tool"]
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.localizationpriority: medium
-ms.author: greglin
-ms.topic: article
-ms.date: 12/03/2018
-ms.reviewer:
-manager: dansimp
-author: greg-lindsay
----
-
-# Repackage existing win32 applications to the MSIX format
-
-MSIX is a packaging format built to be safe, secure and reliable, based on a combination of .msi, .appx, App-V and ClickOnce installation technologies. You can [use the MSIX packaging tool](/windows/msix/packaging-tool/create-app-package-msi-vm) to repackage your existing Win32 applications to the MSIX format.
-
-You can either run your installer interactively (through the UI) or create a package from the command line. Either way, you can convert an application without having the source code. Then, you can make your app available through the Microsoft Store.
-
-- [Package your favorite application installer](/windows/msix/packaging-tool/create-app-package-msi-vm) interactively (msi, exe, App-V 5.x and ClickOnce) in MSIX format.
-- Create a [modification package](/windows/msix/packaging-tool/package-editor) to update an existing MSIX package.
-- [Bundle multiple MSIX packages](/windows/msix/packaging-tool/bundle-msix-packages) for distribution.
-
-## Installing the MSIX Packaging Tool
-
-### Prerequisites
-
-- Windows 10, version 1809 (or later)
-- Participation in the Windows Insider Program (if you're using an Insider build)
-- A valid Microsoft work or school account to access the app from the Microsoft Store
-- Admin privileges on your PC account
-
-### Get the app from the Microsoft Store
-
-1. Use the Microsoft work or school account login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF).
-2. Open the product description page.
-3. Click the install icon to begin installation.
\ No newline at end of file
diff --git a/windows/application-management/provisioned-apps-windows-client-os.md b/windows/application-management/provisioned-apps-windows-client-os.md
new file mode 100644
index 0000000000..48795d6801
--- /dev/null
+++ b/windows/application-management/provisioned-apps-windows-client-os.md
@@ -0,0 +1,475 @@
+---
+title: Get the provisioned apps on Windows client operating system | Microsoft Docs
+ms.reviewer:
+manager: dougeby
+description: Use the Windows PowerShell Get-AppxProvisionedPackage command to get a list off the provisioned apps installed in Windows OS. See a list of some common provisioned apps installed a Windows Enterprise client computer or device, including Windows 10.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: mobile
+ms.author: mandia
+author: MandiOhlinger
+ms.localizationpriority: medium
+ms.topic: article
+---
+
+# Provisioned apps installed with the Windows client OS
+
+> Applies to:
+>
+> - Windows 10
+
+Provisioned apps are included with the OS, and automatically installed when a user signs into a Windows device the first time. They are per-user apps, and typically installed in the `C:\Program Files\WindowsApps` folder. On your Windows devices, you can use Windows PowerShell to see the provisioned apps automatically installed.
+
+This article lists some of the built-in provisioned apps on the different Windows client OS versions, and lists the Windows PowerShell command to get a list.
+
+## Use Windows PowerShell
+
+To get a list of all the provisioned apps, use Windows PowerShell:
+
+1. Open the Windows PowerShell app as administrator.
+2. Run the following script:
+
+ ```Powershell
+ Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName
+ ```
+
+The output lists all the provisioned apps, and their package names. For more information on this command, see [Get-AppxProvisionedPackage](/powershell/module/dism/get-appxprovisionedpackage) (opens another Microsoft website).
+
+## Built-in provisioned apps list
+
+The following information lists some of the provisioned apps on the different Windows Enterprise client OS versions. Your specific OS version and image may have different apps. To confirm your app list, run the [PowerShell Get-AppxProvisionedPackage command](#use-windows-powershell) (in this article).
+
+Provisioned apps are also listed in **Settings** > **Apps and Features**.
+
+- [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | Package name: Microsoft.3DBuilder
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ✔️ | ✔️ | | | | | |
+
+ ---
+
+- [Bing Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | Package name: Microsoft.BingWeather
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ✔️ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Desktop App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | Package name: Microsoft.DesktopAppInstaller
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | Use Settings App | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | Package name: Microsoft.GetHelp
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | Package name: Microsoft.Getstarted
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.HEIFImageExtension
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | Package name:Microsoft.Messaging
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft 3D Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | Package name: Microsoft.Microsoft3DViewer
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftOfficeHub
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftSolitaireCollection
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftStickyNotes
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | Package name: Microsoft.MixedReality.Portal
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | Package name: Microsoft.MSPaint
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | Package name: Microsoft.Office.OneNote
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | Package name: Microsoft.OneConnect
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
+
+ ---
+
+- Microsoft.Outlook.DesktopIntegrationServices
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | | ✔️ | ✔️| | ✔️| | |
+
+ ---
+
+- [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | Package name: Microsoft.People
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | Package name: Microsoft.Print3D
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | Package name: Microsoft.ScreenSketch
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | Package name: Microsoft.SkypeApp
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | Package name: Microsoft.StorePurchaseApp
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- Microsoft.VP9VideoExtensions
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | Package name: Microsoft.Wallet
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | Package name: Microsoft.WebMediaExtensions
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.WebpImageExtension
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | Package name: Microsoft.Windows.Photos
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | Package name: Microsoft.WindowsAlarms
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCalculator
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCamera
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | Package name: microsoft.windowscommunicationsapps
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | Package name: Microsoft.WindowsFeedbackHub
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | Package name: Microsoft.WindowsMaps
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | Package name: Microsoft.WindowsSoundRecorder
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | Package name: Microsoft.WindowsStore
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+ - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you must restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it.
+
+- [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | Package name: Microsoft.Xbox.TCUI
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | Package name: Microsoft.XboxApp
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGameOverlay
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGamingOverlay
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | Package name: Microsoft.XboxIdentityProvider
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- Microsoft.XboxSpeechToTextOverlay
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | Package name: Microsoft.YourPhone
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | Package name: Microsoft.ZuneMusic
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
+
+- [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | Package name: Microsoft.ZuneVideo
+ - Supported versions:
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 |
+ | --- | --- | --- | --- | --- | --- |--- |
+ | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️|
+
+ ---
diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md
index 4759d12a8c..11defe4f8f 100644
--- a/windows/application-management/sideload-apps-in-windows-10.md
+++ b/windows/application-management/sideload-apps-in-windows-10.md
@@ -1,93 +1,107 @@
---
-title: Sideload LOB apps in Windows 10 (Windows 10)
-description: Learn how to sideload line-of-business (LOB) apps in Windows 10. When you sideload an app, you deploy a signed app package to a device.
+title: Sideload LOB apps in Windows client OS | Microsoft Docs
+description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems, including Windows 10. When you sideload an app, you deploy a signed app package to a device.
ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D
ms.reviewer:
-manager: dansimp
+manager: dougeby
ms.author: greglin
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: mobile
author: greg-lindsay
-ms.date: 05/20/2019
+ms.date: 08/30/2021
+ms.localizationpriority: medium
---
-# Sideload LOB apps in Windows 10
+# Sideload line of business (LOB) apps in Windows client devices
-**Applies to**
-
-- Windows 10
+> Applies to:
+>
+> - Windows 10
> [!NOTE]
-> As of Windows Insider Build 18956, sideloading is enabled by default. Now, you can deploy a signed package onto a device without a special configuration.
+> As of Windows Insider Build 18956, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration.
-"Line-of-Business" (LOB) apps are present in a wide range of businesses and organizations. Organizations value these apps because they solve problems unique to each business.
+Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft store. Your organization may create its own apps, including line-of-business (LOB) apps. Many organizations create their own apps to solve problems unique to their business.
When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1
-In Windows 10, sideloading is different than in earlier versions of Windows:
+Starting with Windows 10, sideloading is different than earlier versions of Windows:
-- You can unlock a device for sideloading using an enterprise policy, or through **Settings**
+- You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app.
+- License keys aren't required.
+- Devices don't have to be joined to a domain.
-- License keys are not required
+To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices.
-- Devices do not have to be joined to a domain
+This article shows you how to:
-## Requirements
-Here's what you'll need to have:
+- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use the **Settings** app to turn on sideloading.
+- **Install the app certificate**: Import the security certificate to the local device. This certificate tells the local device to trust the app.
+- **Install the app**: Use Windows PowerShell to install the app package.
-- Devices need to be unlocked for sideloading (unlock policy enabled)
+## Prerequisites
-- Certificate assigned to app
+- Windows devices that are unlocked for sideloading (unlock policy enabled). Meaning, sideloading isn't blocked by a policy.
+- A trusted certificate that's assigned to your app.
+- An app package that's signed with your certificate.
-- Signed app package
+## Step 1: Turn on sideloading
-And here's what you'll need to do:
-
-- Turn on sideloading - you can push a policy with an MDM provider, or you can use **Settings**.
-
-- Trust the app - import the security certificate to the local device.
-
-- Install the app - use PowerShell to install the app package.
-
-## How do I sideload an app on desktop
You can sideload apps on managed or unmanaged devices.
->[!IMPORTANT]
-> To install an app on Windows 10, in addition to following [these procedures](/windows/msix/app-installer/installing-windows10-apps-web), users can also double-click any APPX/MSIX package.
+Managed devices are typically owned by your organization. They're managed by Group Policy (on-premises), or a Mobile Device Management (MDM) provider, such as Microsoft Intune (cloud). Bring your own devices (BYOD) and personal devices can also be managed by your organization. On managed devices, you can create a policy that turns on sideloading, and then deploy this policy to your Windows devices.
+Unmanaged devices are devices that are not managed by your organization. These devices are typically personal devices owned by users. Users can turn on sideloading using the Settings app.
-**To turn on sideloading for managed devices**
+> [!IMPORTANT]
+> To install an app on Windows 10 and later, you can:
+>
+> - [Install Windows 10 apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web).
+> - Users can double-click any `.APPX` or `.MSIX` package.
-- Deploy an enterprise policy.
+### User interface
+If you're working on your own device, or if devices are unmanaged, use the Settings app:
+1. Open the **Settings** app > **Update & Security** > **For developers**.
+2. Select **Sideload apps**.
-**To turn on sideloading for unmanaged devices**
+For more information, see [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) and [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging).
-1. Open **Settings**.
+### Group Policy
-2. Click **Update & Security** > **For developers**.
+If you use Group Policy, use the `Computer Configuration\Administrative Templates\Windows Components\App Package Deployment` policies to enable or prevent sideloading apps:
-3. On **Use developer features**, select **Sideload apps**.
+- `Allows development of Windows Store apps and installing them from an integrated development environment (IDE)`
+- `Allow all trusted apps to install`
-**To import the security certificate**
+By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps.
-1. Open the security certificate for the appx package, and select **Install Certificate**.
+### MDM
-2. On the **Certificate Import Wizard**, select **Local Machine**.
+Using Microsoft Intune, you can also enable sideloading apps on managed devices. For more information, see:
-3. Import the certificate to the **Trusted Root Certification Authorities** folder.
+- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows)
+- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store)
+
+## Step 2: Import the security certificate
+
+This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device.
+
+1. Open the security certificate for the `.appx` package, and select **Install Certificate**.
+
+2. On the **Certificate Import Wizard**, select **Local Machine**.
+
+3. Import the certificate to the **Trusted Root Certification Authorities** folder.
-OR-
- You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package to a Windows 10 device, see runtime instructions on [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=619162).
+ You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package to a Windows 10 device, see runtime instructions on [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
-**To install the app**
-- From the folder with the appx package, run the PowerShell `Add-AppxPackage` command to install the appx package.
+## Step 3: Install the app
+From the folder with the `.appx` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.appx` package.
-
-
-
\ No newline at end of file
+For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage).
diff --git a/windows/application-management/system-apps-windows-client-os.md b/windows/application-management/system-apps-windows-client-os.md
new file mode 100644
index 0000000000..6ebea1ded8
--- /dev/null
+++ b/windows/application-management/system-apps-windows-client-os.md
@@ -0,0 +1,356 @@
+---
+title: Get the system apps on Windows client operating system | Microsoft Docs
+ms.reviewer:
+manager: dougeby
+description: Use the Windows PowerShell Get-AppxPackage command to get a list off the system apps installed in Windows OS. See a list of some common system apps installed a Windows Enterprise client computer or device, including Windows 10.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: mobile
+ms.author: mandia
+author: MandiOhlinger
+ms.localizationpriority: medium
+ms.topic: article
+---
+
+# System apps installed with the Windows client OS
+
+> Applies to:
+>
+> - Windows 10
+
+On all Windows devices, the OS automatically installs some apps. These apps are called system apps, and are typically installed in the `C:\Windows\` folder. On your Windows devices, you can use Windows PowerShell to see the system apps automatically installed.
+
+This article lists the built-in system apps on some Windows OS versions, and lists the Windows PowerShell command to get a list.
+
+## Use Windows PowerShell
+
+To get a list of all the system apps, use Windows PowerShell:
+
+1. Open the Windows PowerShell app as administrator.
+2. Run the following script:
+
+ ```Powershell
+ Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation
+ ```
+
+The output lists all the system apps, and their installation location. For more information on this command, see [Get-AppxPackage](/powershell/module/appx/get-appxpackage) (opens another Microsoft website).
+
+## Built-in system apps list
+
+The following information lists the system apps on some Windows Enterprise OS versions. Your specific OS version and image may have different apps. To confirm your app list, run the [PowerShell Get-AppxPackage command](#use-windows-powershell) (in this article).
+
+- File Picker | Package name: 1527c705-839a-4832-9118-54d4Bd6a0c89
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- File Explorer | Package name: c5e2524a-ea46-4f67-841f-6a9465d9d515
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- App Resolver UX | Package name: E2A4F912-2574-4A75-9BB0-0D023378592B
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Add Suggested Folders To Library | Package name: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- InputApp
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | | | ✔️ |
+
+ ---
+
+- Microsoft.AAD.Broker.Plugin | Package name: Microsoft.AAD.Broker.Plugin
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.AccountsControl | Package name: Microsoft.AccountsControl
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.AsyncTextService | Package name: Microsoft.AsyncTextService
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Hello setup UI | Package name: Microsoft.BioEnrollment
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.CredDialogHost
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.ECApp
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.LockApp
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft Edge | Package name: Microsoft.MicrosoftEdge
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.MicrosoftEdgeDevToolsClient
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.PPIProjection
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | | | ✔️ |
+
+ ---
+
+- Microsoft.Win32WebViewHost
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.Apprep.ChxApp
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.AssignedAccessLockApp
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.CapturePicker
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.CloudExperienceHost
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.ContentDeliveryManager
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Cortana | Package name: Microsoft.Windows.Cortana
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | | | ✔️ |
+
+ ---
+
+- Microsoft.Windows.OOBENetworkCaptivePort
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.OOBENetworkConnectionFlow
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.ParentalControls
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- People Hub | Package name: Microsoft.Windows.PeopleExperienceHost
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.PinningConfirmationDialog
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.SecHealthUI
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.Windows.SecureAssessmentBrowser
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Start | Package name: Microsoft.Windows.ShellExperienceHost
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Microsoft.XboxGameCallableUI
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Windows.CBSPreview
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Settings | Package name: Windows.immersivecontrolpanel
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
+
+- Print 3D | Package name: Windows.Print3D
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ✔️ | | | ✔️ |
+
+ ---
+
+- Print UI | Package name: Windows.PrintDialog
+
+ ---
+ | Uninstall through UI? | 21H1 | 20H2 | 1809 |
+ | --- | --- | --- | --- |
+ | ❌ | ✔️ | ✔️| ✔️ |
+
+ ---
diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml
index 0b62f25cbb..6847361924 100644
--- a/windows/application-management/toc.yml
+++ b/windows/application-management/toc.yml
@@ -3,9 +3,15 @@ items:
href: index.yml
- name: Application management
items:
- - name: Apps in Windows 10
- href: apps-in-windows-10.md
- - name: Add apps and features in Windows 10
+ - name: Apps in Windows client OS
+ items:
+ - name: Common app types
+ href: apps-in-windows-10.md
+ - name: Provisioned apps in Windows client OS
+ href: provisioned-apps-windows-client-os.md
+ - name: System apps in Windows client OS
+ href: system-apps-windows-client-os.md
+ - name: Add features in Windows client
href: add-apps-and-features.md
- name: Sideload apps
href: sideload-apps-in-windows-10.md
@@ -13,8 +19,6 @@ items:
href: enterprise-background-activity-controls.md
- name: Enable or block Windows Mixed Reality apps in the enterprise
href: manage-windows-mixed-reality.md
- - name: Repackage win32 apps in the MSIX format
- href: msix-app-packaging-tool.md
- name: Application Virtualization (App-V)
items:
- name: App-V for Windows 10 overview
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
index b5361a656c..550cddc3cc 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
@@ -25,7 +25,7 @@ ms.reviewer:
- Cloud only, Hybrid, and On-premises only Windows Hello for Business deployments
- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices
-Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md).
+Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) to establish a remote desktop protocol connection.
Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release.
@@ -38,7 +38,7 @@ Microsoft continues to investigate supporting using keys trust for supplied cred
- Biometric enrollments
- Windows 10, version 1809
-Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809.
+Users using earlier versions of Windows 10 could authenticate to a remote desktop using Windows Hello for Business but were limited to using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809.
### How does it work
@@ -69,4 +69,4 @@ Users appreciate convenience of biometrics and administrators value the security
- [Windows Hello and password changes](hello-and-password-changes.md)
- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md)
- [Event ID 300 - Windows Hello successfully created](hello-event-300.md)
-- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)
\ No newline at end of file
+- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)
diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md
index f06ae93261..9229244aa8 100644
--- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md
+++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md
@@ -1,7 +1,6 @@
---
-title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10)
+title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows)
description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings.
-keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
ms.prod: m365-security
ms.mktglfcycl: explore
ms.sitesec: library
@@ -18,10 +17,11 @@ ms.technology: mde
**Applies to:**
- Windows 10
+- Windows 11
Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely.
-See [Windows 10 (and later) settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune.
+See [Windows 10 (and Windows 11) settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune.
## Group Policy settings
@@ -45,7 +45,7 @@ SmartScreen uses registry-based Administrative Template policy settings.
PreventSmartScreenPromptOverrideForFiles |
-Windows 10, Version 1511 and later |
+Windows 10, Version 1511 and Windows 11 |
- URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
index 146b20c787..baf718b6fe 100644
--- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
@@ -1,7 +1,6 @@
---
-title: Microsoft Defender SmartScreen overview (Windows 10)
+title: Microsoft Defender SmartScreen overview (Windows)
description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
-keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
ms.prod: m365-security
ms.mktglfcycl: explore
ms.sitesec: library
@@ -20,6 +19,7 @@ ms.technology: mde
**Applies to:**
- Windows 10
+- Windows 11
- Microsoft Edge
Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md
index 89c036958f..416b3ffd6e 100644
--- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md
+++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md
@@ -1,7 +1,6 @@
---
-title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows 10)
+title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows)
description: Learn how employees can use Windows Security to set up Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects users from running malicious apps.
-keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
ms.prod: m365-security
ms.mktglfcycl: explore
ms.sitesec: library
@@ -19,6 +18,7 @@ ms.technology: mde
**Applies to:**
- Windows 10, version 1703
+- Windows 11
- Microsoft Edge
Microsoft Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files.
diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md
index 8a31f70d8e..9c23deaecd 100644
--- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md
+++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md
@@ -1,5 +1,5 @@
---
-title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows 10)
+title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows)
description: Using WDAC supplemental policies, you can expand the S mode base policy on your Intune-managed devices.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,10 +23,14 @@ ms.technology: mde
**Applies to:**
- Windows 10
+- Windows 11
-Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices.
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
-With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization".
+Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications and Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows in S mode devices.
+
+With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization".
Refer to the below video for an overview and brief demo.
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp]
@@ -42,18 +46,18 @@ The general steps for expanding the S mode base policy on your Intune-managed de
Refer to [Deploy multiple Windows Defender Application Control Policies](deploy-multiple-windows-defender-application-control-policies.md) for guidance on creating supplemental policies and [Deploy Windows Defender Application Control policy rules and file rules](select-types-of-rules-to-create.md) to choose the right type of rules to create for your policy.
Below are a basic set of instructions for creating an S mode supplemental policy:
- - Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps)
+ - Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps&preserve-view=true)
```powershell
New-CIPolicy -MultiplePolicyFormat -ScanPath -UserPEs -FilePath "\SupplementalPolicy.xml" -Level Publisher -Fallback Hash
```
- - Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps)
+ - Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps&preserve-view=true)
```powershell
Set-CIPolicyIdInfo -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath "\SupplementalPolicy.xml"
```
Policies which are supplementing the S mode base policy must use **-SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784**, as this is the S mode policy ID.
- - Put the policy in enforce mode using [Set-RuleOption](/powershell/module/configci/set-ruleoption?view=win10-ps)
+ - Put the policy in enforce mode using [Set-RuleOption](/powershell/module/configci/set-ruleoption?view=win10-ps&preserve-view=true)
```powershell
Set-RuleOption -FilePath "\SupplementalPolicy.xml>" -Option 3 –Delete
@@ -64,7 +68,7 @@ The general steps for expanding the S mode base policy on your Intune-managed de
```powershell
Add-SignerRule -FilePath -CertificatePath -User -Update
```
- - Convert to .bin using [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy?view=win10-ps)
+ - Convert to .bin using [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy?view=win10-ps&preserve-view=true)
```powershell
ConvertFrom-CIPolicy -XmlFilePath "\SupplementalPolicy.xml" -BinaryFilePath "\SupplementalPolicy.bin>
@@ -81,7 +85,7 @@ The general steps for expanding the S mode base policy on your Intune-managed de
Go to the Azure portal online and navigate to the Microsoft Intune page, then go to the Client apps blade and select 'S mode supplemental policies'. Upload the signed policy to Intune and assign it to user or device groups. Intune will generate tenant- and device- specific authorization tokens. Intune then deploys the corresponding authorization token and supplemental policy to each device in the assigned group. Together, these expand the S mode base policy on the device.
> [!Note]
-> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps) for information on setting the version number.
+> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps&preserve-view=true) for information on setting the version number.
## Standard Process for Deploying Apps through Intune

@@ -238,4 +242,4 @@ IT Pros also have the choice of deleting a supplemental policy through Intune.
```
## Errata
-If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active.
\ No newline at end of file
+If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active.
diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
index 4b3eb396a8..107430388b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
@@ -1,5 +1,5 @@
---
-title: Allow COM object registration in a WDAC policy (Windows 10)
+title: Allow COM object registration in a WDAC policy (Windows)
description: You can allow COM object registration in a Windows Defender Application Control policy.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,17 +22,20 @@ ms.technology: mde
**Applies to:**
- Windows 10
-- Windows Server 2016
-- Windows Server 2019
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
>[!IMPORTANT]
->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+>Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The [Microsoft Component Object Model (COM)](/windows/desktop/com/the-component-object-model) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM specifies an object model and programming requirements that enable COM objects to interact with other objects.
### COM object configurability in WDAC policy
-Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy.
+Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy.
**NOTE**: To add this functionality to other versions of Windows 10, you can install the following or later updates:
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
index aafd72be3d..9036f3e4c1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
@@ -1,5 +1,5 @@
---
-title: Add rules for packaged apps to existing AppLocker rule-set (Windows 10)
+title: Add rules for packaged apps to existing AppLocker rule-set (Windows)
description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).
ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Add rules for packaged apps to existing AppLocker rule-set
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
index 105e16241c..7f2698f4c6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
@@ -1,5 +1,5 @@
---
-title: Administer AppLocker (Windows 10)
+title: Administer AppLocker (Windows)
description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies.
ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Administer AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
index 04a1ea12ad..44cb55c39e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
@@ -1,5 +1,5 @@
---
-title: AppLocker architecture and components (Windows 10)
+title: AppLocker architecture and components (Windows)
description: This topic for IT professional describes AppLocker’s basic architecture and its major components.
ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker architecture and components
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professional describes AppLocker’s basic architecture and its major components.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
index d28879a339..c6b0e3ecf4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
@@ -1,5 +1,5 @@
---
-title: AppLocker functions (Windows 10)
+title: AppLocker functions (Windows)
description: This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features.
ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker functions
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
index 29d54546be..93a162dc9a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md
@@ -1,5 +1,5 @@
---
-title: AppLocker (Windows 10)
+title: AppLocker (Windows)
description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies.
ms.assetid: 94b57864-2112-43b6-96fb-2863c985dc9a
ms.reviewer:
@@ -21,10 +21,15 @@ ms.technology: mde
# AppLocker
**Applies to**
-- Windows 10
-- Windows Server
-This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
+
+This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.
> [!NOTE]
> AppLocker is unable to control processes running under the system account on any operating system.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
index 60bc44e368..86a8829b86 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
@@ -1,5 +1,5 @@
---
-title: AppLocker deployment guide (Windows 10)
+title: AppLocker deployment guide (Windows)
description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies.
ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1
ms.reviewer:
@@ -22,8 +22,13 @@ ms.technology: mde
# AppLocker deployment guide
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
index 960362fe53..a7d286ac77 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
@@ -1,5 +1,5 @@
---
-title: AppLocker design guide (Windows 10)
+title: AppLocker design guide (Windows)
description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker.
ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker design guide
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
index 897753b906..9afaf76dd4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
@@ -1,5 +1,5 @@
---
-title: AppLocker policy use scenarios (Windows 10)
+title: AppLocker policy use scenarios (Windows)
description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented.
ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker policy use scenarios
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented.
@@ -34,7 +39,7 @@ AppLocker can help you improve the management of application control and the mai
2. **Protection against unwanted software**
- AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app is not specifically identified by its publisher, installation path, or file hash, the attempt to run the application fails.
+ AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app is not identified by its publisher, installation path, or file hash, the attempt to run the application fails.
3. **Licensing conformance**
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
index 0ffdf6a6e0..72c593b20b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
@@ -1,5 +1,5 @@
---
-title: AppLocker processes and interactions (Windows 10)
+title: AppLocker processes and interactions (Windows)
description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules.
ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker processes and interactions
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
index 56d2fcb24d..e6ffbc2ba9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
@@ -1,5 +1,5 @@
---
-title: AppLocker settings (Windows 10)
+title: AppLocker settings (Windows)
description: This topic for the IT professional lists the settings used by AppLocker.
ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker settings
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional lists the settings used by AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
index db60e0f7bc..49e952d360 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
@@ -1,5 +1,5 @@
---
-title: AppLocker technical reference (Windows 10)
+title: AppLocker technical reference (Windows)
description: This overview topic for IT professionals provides links to the topics in the technical reference.
ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# AppLocker technical reference
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This overview topic for IT professionals provides links to the topics in the technical reference.
AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
index 8995d1c8cf..44e68d79c2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
@@ -1,5 +1,5 @@
---
-title: Configure an AppLocker policy for audit only (Windows 10)
+title: Configure an AppLocker policy for audit only (Windows)
description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker.
ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Configure an AppLocker policy for audit only
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
index 1f3d8928cf..e59657993f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
@@ -1,5 +1,5 @@
---
-title: Configure an AppLocker policy for enforce rules (Windows 10)
+title: Configure an AppLocker policy for enforce rules (Windows)
description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.
ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Configure an AppLocker policy for enforce rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
index fea958441d..a018cafadb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
@@ -1,5 +1,5 @@
---
-title: Add exceptions for an AppLocker rule (Windows 10)
+title: Add exceptions for an AppLocker rule (Windows)
description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.
ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Add exceptions for an AppLocker rule
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
index 9b81e3d6fe..e836660931 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
@@ -1,5 +1,5 @@
---
-title: Configure the AppLocker reference device (Windows 10)
+title: Configure the AppLocker reference device (Windows)
description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer.
ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Configure the AppLocker reference device
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
index 83c7422028..0501a133b2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
@@ -1,5 +1,5 @@
---
-title: Configure the Application Identity service (Windows 10)
+title: Configure the Application Identity service (Windows)
description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.
ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Configure the Application Identity service
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
index e7c76c7e98..eecd667d2b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
@@ -1,5 +1,5 @@
---
-title: Create a rule for packaged apps (Windows 10)
+title: Create a rule for packaged apps (Windows)
description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.
ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create a rule for packaged apps
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.
@@ -32,7 +37,7 @@ Packaged apps, also known as Universal Windows apps, are based on an app model t
- Package name
- Package version
-All the files within a package as well as the package installer share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation as well as the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups.
+All the files within a package and the package installers share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation and the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups.
For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md).
@@ -67,7 +72,7 @@ You can perform this task by using the Group Policy Management Console for an Ap
Use a packaged app installer as a reference |
If selected, AppLocker requires you to choose an app installer on which to base your new rule. A packaged app installer has the .appx extension. AppLocker uses the publisher, package name, and package version of the installer to define the rule. |
- Your company has developed a number of internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule. |
+ Your company has developed many internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule. |
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
index c68870383e..141694e9b1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
@@ -1,5 +1,5 @@
---
-title: Create a rule that uses a file hash condition (Windows 10)
+title: Create a rule that uses a file hash condition (Windows)
description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.
ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create a rule that uses a file hash condition
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
index fd4ebfd86a..3efd61d7e9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
@@ -1,5 +1,5 @@
---
-title: Create a rule that uses a path condition (Windows 10)
+title: Create a rule that uses a path condition (Windows)
description: This topic for IT professionals shows how to create an AppLocker rule with a path condition.
ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create a rule that uses a path condition
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals shows how to create an AppLocker rule with a path condition.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
index f7f9061767..8554f3c9f2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
@@ -1,5 +1,5 @@
---
-title: Create a rule that uses a publisher condition (Windows 10)
+title: Create a rule that uses a publisher condition (Windows)
description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.
ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create a rule that uses a publisher condition
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
index 8e818f8d12..1b41d7d17d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
@@ -1,5 +1,5 @@
---
-title: Create AppLocker default rules (Windows 10)
+title: Create AppLocker default rules (Windows)
description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.
ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create AppLocker default rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
index 9d57825f8a..61d80caa45 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
@@ -1,5 +1,5 @@
---
-title: Create a list of apps deployed to each business group (Windows 10)
+title: Create a list of apps deployed to each business group (Windows)
description: This topic describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker.
ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create a list of apps deployed to each business group
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
index d0a53377ec..a4dd6d3cbb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Create Your AppLocker policies (Windows 10)
+title: Create Your AppLocker policies (Windows)
description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment.
ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create Your AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
index dd866880d3..49afa8e599 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
@@ -1,5 +1,5 @@
---
-title: Create Your AppLocker rules (Windows 10)
+title: Create Your AppLocker rules (Windows)
description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules.
ms.assetid: b684a3a5-929c-4f70-8742-04088022f232
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Create Your AppLocker rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
index 37cc05e7a2..d99290ca20 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
@@ -1,5 +1,5 @@
---
-title: Delete an AppLocker rule (Windows 10)
+title: Delete an AppLocker rule (Windows)
description: This article for IT professionals describes the steps to delete an AppLocker rule.
ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Delete an AppLocker rule
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This article for IT professionals describes the steps to delete an AppLocker rule.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
index bd480092c0..4eacf25176 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
@@ -1,5 +1,5 @@
---
-title: Deploy AppLocker policies by using the enforce rules setting (Windows 10)
+title: Deploy AppLocker policies by using the enforce rules setting (Windows)
description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method.
ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Deploy AppLocker policies by using the enforce rules setting
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
index 64f60860f0..1cef053c49 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
@@ -1,5 +1,5 @@
---
-title: Deploy the AppLocker policy into production (Windows 10)
+title: Deploy the AppLocker policy into production (Windows)
description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings.
ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Deploy the AppLocker policy into production
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
index fdeb9db2dc..4e97c71abe 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
@@ -1,5 +1,5 @@
---
-title: Determine the Group Policy structure and rule enforcement (Windows 10)
+title: Determine the Group Policy structure and rule enforcement (Windows)
description: This overview topic describes the process to follow when you are planning to deploy AppLocker rules.
ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Determine the Group Policy structure and rule enforcement
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This overview topic describes the process to follow when you are planning to deploy AppLocker rules.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
index 44775ea2d0..cd61c3ae04 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
@@ -1,5 +1,5 @@
---
-title: Find digitally signed apps on a reference device (Windows 10)
+title: Find digitally signed apps on a reference device (Windows)
description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed.
ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Determine which apps are digitally signed on a reference device
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
index 516f7eaff2..90e037220c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
@@ -1,5 +1,5 @@
---
-title: Determine your application control objectives (Windows 10)
+title: Determine your application control objectives (Windows)
description: Determine which applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker.
ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Determine your application control objectives
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This article helps with decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
index 4f89790b1c..0337e87f46 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
@@ -1,5 +1,5 @@
---
-title: Display a custom URL message when users try to run a blocked app (Windows 10)
+title: Display a custom URL message when users try to run a blocked app (Windows)
description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.
ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Display a custom URL message when users try to run a blocked app
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
index aec41fda97..f547e9a47c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: DLL rules in AppLocker (Windows 10)
+title: DLL rules in AppLocker (Windows)
description: This topic describes the file formats and available default rules for the DLL rule collection.
ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# DLL rules in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the file formats and available default rules for the DLL rule collection.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
index 7c80353023..94b76c08b1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
@@ -1,5 +1,5 @@
---
-title: Document Group Policy structure & AppLocker rule enforcement (Windows 10)
+title: Document Group Policy structure & AppLocker rule enforcement (Windows)
description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker.
ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Document the Group Policy structure and AppLocker rule enforcement
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
index 64318e0bd7..abace52005 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
@@ -1,5 +1,5 @@
---
-title: Document your app list (Windows 10)
+title: Document your app list (Windows)
description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies.
ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Document your app list
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
index 3fa11e947f..61e0ea6cd7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
@@ -1,5 +1,5 @@
---
-title: Document your AppLocker rules (Windows 10)
+title: Document your AppLocker rules (Windows)
description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation.
ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Document your AppLocker rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes what AppLocker rule conditions to associate with each file, how to associate these rule conditions, the source of the rule, and whether the file should be included or excluded.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
index 9865b4a5d9..d9503e8a00 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
@@ -1,5 +1,5 @@
---
-title: Edit an AppLocker policy (Windows 10)
+title: Edit an AppLocker policy (Windows)
description: This topic for IT professionals describes the steps required to modify an AppLocker policy.
ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Edit an AppLocker policy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps required to modify an AppLocker policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
index 9fba4220b8..ae57316f95 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
@@ -1,5 +1,5 @@
---
-title: Edit AppLocker rules (Windows 10)
+title: Edit AppLocker rules (Windows)
description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.
ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Edit AppLocker rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
index 33f8fc5205..a7127c01e3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
@@ -1,5 +1,5 @@
---
-title: Enable the DLL rule collection (Windows 10)
+title: Enable the DLL rule collection (Windows)
description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.
ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Enable the DLL rule collection
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
index 977c71d0cf..d5af5704b4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
@@ -1,5 +1,5 @@
---
-title: Enforce AppLocker rules (Windows 10)
+title: Enforce AppLocker rules (Windows)
description: This topic for IT professionals describes how to enforce application control rules by using AppLocker.
ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Enforce AppLocker rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to enforce application control rules by using AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
index 13e0194acf..4a08f289bb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Executable rules in AppLocker (Windows 10)
+title: Executable rules in AppLocker (Windows)
description: This topic describes the file formats and available default rules for the executable rule collection.
ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Executable rules in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the file formats and available default rules for the executable rule collection.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
index 6f17980018..6a31ee8659 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
@@ -1,5 +1,5 @@
---
-title: Export an AppLocker policy from a GPO (Windows 10)
+title: Export an AppLocker policy from a GPO (Windows)
description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.
ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Export an AppLocker policy from a GPO
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
index a2c2fda488..b31a06093c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
@@ -1,5 +1,5 @@
---
-title: Export an AppLocker policy to an XML file (Windows 10)
+title: Export an AppLocker policy to an XML file (Windows)
description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.
ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Export an AppLocker policy to an XML file
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.
Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
index 6e4827d32a..a69c492e7b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
@@ -1,5 +1,5 @@
---
-title: How AppLocker works (Windows 10)
+title: How AppLocker works (Windows)
description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies.
ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# How AppLocker works
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
index 572410407e..ee2571025c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
@@ -1,5 +1,5 @@
---
-title: Import an AppLocker policy from another computer (Windows 10)
+title: Import an AppLocker policy from another computer (Windows)
description: This topic for IT professionals describes how to import an AppLocker policy.
ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Import an AppLocker policy from another computer
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to import an AppLocker policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
index 10cdc3f2c5..a1f2c8e829 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
@@ -1,5 +1,5 @@
---
-title: Import an AppLocker policy into a GPO (Windows 10)
+title: Import an AppLocker policy into a GPO (Windows)
description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).
ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Import an AppLocker policy into a GPO
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).
AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
index 45ecd00528..495e5578cb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Maintain AppLocker policies (Windows 10)
+title: Maintain AppLocker policies (Windows)
description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies.
ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc
ms.reviewer:
@@ -20,8 +20,13 @@ ms.technology: mde
# Maintain AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes how to maintain rules within AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
index 5629e15a24..963ec6547b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
@@ -1,5 +1,5 @@
---
-title: Manage packaged apps with AppLocker (Windows 10)
+title: Manage packaged apps with AppLocker (Windows)
description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy.
ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Manage packaged apps with AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
index 3701ca5daf..1034d8e194 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
@@ -1,5 +1,5 @@
---
-title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10)
+title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows)
description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Merge AppLocker policies by using Set-ApplockerPolicy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
index 7567707461..c6beb49771 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
@@ -1,5 +1,5 @@
---
-title: Merge AppLocker policies manually (Windows 10)
+title: Merge AppLocker policies manually (Windows)
description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).
ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Merge AppLocker policies manually
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
index 56d201be4e..15bd4e6197 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
@@ -1,5 +1,5 @@
---
-title: Monitor app usage with AppLocker (Windows 10)
+title: Monitor app usage with AppLocker (Windows)
description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied.
ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Monitor app usage with AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
index 48b6672c34..15357f0a4c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
@@ -1,5 +1,5 @@
---
-title: Optimize AppLocker performance (Windows 10)
+title: Optimize AppLocker performance (Windows)
description: This topic for IT professionals describes how to optimize AppLocker policy enforcement.
ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Optimize AppLocker performance
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how to optimize AppLocker policy enforcement.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
index 5889dda71b..7cd27ec5a6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Packaged apps and packaged app installer rules in AppLocker (Windows 10)
+title: Packaged apps and packaged app installer rules in AppLocker (Windows)
description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps.
ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Packaged apps and packaged app installer rules in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the AppLocker rule collection for packaged app installers and packaged apps.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
index c905efb4a6..5a2aab5ef9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
@@ -1,5 +1,5 @@
---
-title: Plan for AppLocker policy management (Windows 10)
+title: Plan for AppLocker policy management (Windows)
description: This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies.
ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Plan for AppLocker policy management
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
index 462a865a4f..c306fa8809 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
@@ -1,5 +1,5 @@
---
-title: Refresh an AppLocker policy (Windows 10)
+title: Refresh an AppLocker policy (Windows)
description: This topic for IT professionals describes the steps to force an update for an AppLocker policy.
ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Refresh an AppLocker policy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to force an update for an AppLocker policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
index 8ce0aef841..3d09d68ef3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Requirements for deploying AppLocker policies (Windows 10)
+title: Requirements for deploying AppLocker policies (Windows)
description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies.
ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Requirements for deploying AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
index d4778ed70d..63b249672d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
@@ -1,5 +1,5 @@
---
-title: Requirements to use AppLocker (Windows 10)
+title: Requirements to use AppLocker (Windows)
description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems.
ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Requirements to use AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems.
@@ -38,11 +43,11 @@ To use AppLocker, you need:
## Operating system requirements
-The following table show the on which operating systems AppLocker features are supported.
+The following table shows the on which operating systems AppLocker features are supported.
| Version | Can be configured | Can be enforced | Available rules | Notes |
| - | - | - | - | - |
-| Windows 10| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| You can use the [AppLocker CSP](/windows/client-management/mdm/applocker-csp) to configure AppLocker policies on any edition of Windows 10 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. |
+| Windows 10 and Windows 11| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| You can use the [AppLocker CSP](/windows/client-management/mdm/applocker-csp) to configure AppLocker policies on any edition of Windows 10 and Windows 11 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, and Windows Server 2016. |
| Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows Server 2012| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
| Windows 8.1 Pro| Yes| No| N/A||
| Windows 8.1 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
index da19e309e8..4c9ff4b21a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
@@ -1,5 +1,5 @@
---
-title: Run the Automatically Generate Rules wizard (Windows 10)
+title: Run the Automatically Generate Rules wizard (Windows)
description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.
ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Run the Automatically Generate Rules wizard
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
index db4968297c..4b4ca99f66 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Script rules in AppLocker (Windows 10)
+title: Script rules in AppLocker (Windows)
description: This topic describes the file formats and available default rules for the script rule collection.
ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Script rules in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the file formats and available default rules for the script rule collection.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
index 7e757f7903..006efd19a1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
@@ -1,5 +1,5 @@
---
-title: Security considerations for AppLocker (Windows 10)
+title: Security considerations for AppLocker (Windows)
description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker.
ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Security considerations for AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the security considerations you need to address when implementing AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
index 174e5d8a77..9dedd807d1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
@@ -1,5 +1,5 @@
---
-title: Select the types of rules to create (Windows 10)
+title: Select the types of rules to create (Windows)
description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker.
ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Select the types of rules to create
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic lists resources you can use when selecting your application control policy rules by using AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
index fd78e7c563..ca0dc2f8e4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
@@ -1,5 +1,5 @@
---
-title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10)
+title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows)
description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.
ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Test an AppLocker policy by using Test-AppLockerPolicy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
index 2027085b0e..3a42a9d7aa 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
@@ -1,5 +1,5 @@
---
-title: Test and update an AppLocker policy (Windows 10)
+title: Test and update an AppLocker policy (Windows)
description: This topic discusses the steps required to test an AppLocker policy prior to deployment.
ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Test and update an AppLocker policy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic discusses the steps required to test an AppLocker policy prior to deployment.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
index a39370e796..19eb7cd1d3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
@@ -1,5 +1,5 @@
---
-title: Tools to use with AppLocker (Windows 10)
+title: Tools to use with AppLocker (Windows)
description: This topic for the IT professional describes the tools available to create and administer AppLocker policies.
ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Tools to use with AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the tools available to create and administer AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
index cbd1b7c62e..7058ee0c64 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
@@ -1,5 +1,5 @@
---
-title: Understand AppLocker enforcement settings (Windows 10)
+title: Understand AppLocker enforcement settings (Windows)
description: This topic describes the AppLocker enforcement settings for rule collections.
ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understand AppLocker enforcement settings
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the AppLocker enforcement settings for rule collections.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
index 95dcad5fe6..ccdfd461a6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
@@ -1,5 +1,5 @@
---
-title: Understand AppLocker policy design decisions (Windows 10)
+title: Understand AppLocker policy design decisions (Windows)
description: Review some common considerations while you are planning to use AppLocker to deploy application control policies within a Windows environment.
ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understand AppLocker policy design decisions
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment.
@@ -46,7 +51,7 @@ You might need to control a limited number of apps because they access sensitive
| Possible answers | Design considerations|
| - | - |
| Control all apps | AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).|
-| Control specific apps | When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).|
+| Control specific apps | When you create AppLocker rules, a list of allowed apps is created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).|
|Control only Classic Windows applications, only Universal Windows apps, or both| AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Microsoft Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps. For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.|
| Control apps by business group and user | AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.|
| Control apps by computer, not user | AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.|
@@ -54,7 +59,7 @@ You might need to control a limited number of apps because they access sensitive
>**Important:** The following list contains files or types of files that cannot be managed by AppLocker:
-- AppLocker does not protect against running 16-bit DOS binaries in a NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe.
+- AppLocker does not protect against running 16-bit DOS binaries in an NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe.
- You cannot use AppLocker to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem.
@@ -108,6 +113,7 @@ If your organization supports multiple Windows operating systems, app control po
Your organization's computers are running a combination of the following operating systems:
+Windows 11
Windows 10
Windows 8
Windows 7
@@ -130,6 +136,7 @@ If your organization supports multiple Windows operating systems, app control po
Your organization's computers are running only the following operating systems:
+Windows 11
Windows 10
Windows 8.1
Windows 8
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
index 9ffaf2b82c..5803246cf1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
@@ -1,5 +1,5 @@
---
-title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10)
+title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows)
description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.
ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871
ms.reviewer:
@@ -21,12 +21,17 @@ ms.technology: mde
# Understand AppLocker rules and enforcement setting inheritance in Group Policy
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.
-Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy.
+Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps, and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy.
Group Policy merges AppLocker policy in two ways:
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
index a51539d046..23383522f6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
@@ -1,5 +1,5 @@
---
-title: Understand the AppLocker policy deployment process (Windows 10)
+title: Understand the AppLocker policy deployment process (Windows)
description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies.
ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understand the AppLocker policy deployment process
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
index 941aa4f30d..319498a599 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker allow and deny actions on rules (Windows 10)
+title: Understanding AppLocker allow and deny actions on rules (Windows)
description: This topic explains the differences between allow and deny actions on AppLocker rules.
ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker allow and deny actions on rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the differences between allow and deny actions on AppLocker rules.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
index e9e449b52e..7a33f4dde5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker default rules (Windows 10)
+title: Understanding AppLocker default rules (Windows)
description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied.
ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker default rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
index 041eee8f69..92f40c3d8c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker rule behavior (Windows 10)
+title: Understanding AppLocker rule behavior (Windows)
description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker.
ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker rule behavior
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
index 319c895fd9..e8cf87080b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker rule collections (Windows 10)
+title: Understanding AppLocker rule collections (Windows)
description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies.
ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker rule collections
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the five different types of AppLocker rules used to enforce AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
index 8dfb91c58e..80ce31b642 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker rule condition types (Windows 10)
+title: Understanding AppLocker rule condition types (Windows)
description: This topic for the IT professional describes the three types of AppLocker rule conditions.
ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker rule condition types
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the three types of AppLocker rule conditions.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
index eb3084b691..c4cf8ac3ea 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
@@ -1,5 +1,5 @@
---
-title: Understanding AppLocker rule exceptions (Windows 10)
+title: Understanding AppLocker rule exceptions (Windows)
description: This topic describes the result of applying AppLocker rule exceptions to rule collections.
ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding AppLocker rule exceptions
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the result of applying AppLocker rule exceptions to rule collections.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
index 7a8bfc63d1..1bb2c999af 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Understanding the file hash rule condition in AppLocker (Windows 10)
+title: Understanding the file hash rule condition in AppLocker (Windows)
description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied.
ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding the file hash rule condition in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
index 057a3dabde..e8856ed8ee 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Understanding the path rule condition in AppLocker (Windows 10)
+title: Understanding the path rule condition in AppLocker (Windows)
description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied.
ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding the path rule condition in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
index 8636e3b8dd..8dade37801 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Understanding the publisher rule condition in AppLocker (Windows 10)
+title: Understanding the publisher rule condition in AppLocker (Windows)
description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied.
ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Understanding the publisher rule condition in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
index 228ca42a8d..a283a7ab4f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Use a reference device to create and maintain AppLocker policies (Windows 10)
+title: Use a reference device to create and maintain AppLocker policies (Windows)
description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer.
ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6
ms.author: macapara
@@ -21,8 +21,13 @@ ms.technology: mde
# Use a reference device to create and maintain AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
index b6018803fb..6dcd91c001 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
@@ -1,5 +1,5 @@
---
-title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10)
+title: Use AppLocker and Software Restriction Policies in the same domain (Windows)
description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker.
ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Use AppLocker and Software Restriction Policies in the same domain
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker.
@@ -71,8 +76,8 @@ The following table compares the features and functions of Software Restriction
Enforcement mode |
SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file is allowed to run by default.
-SRP can also be configured in the “allow list mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow. |
-AppLocker by default works in the “allow list mode” where only those files are allowed to run for which there is a matching allow rule. |
+SRP can also be configured in the “allowlist mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.
+AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there is a matching allow rule. |
File types that can be controlled |
@@ -126,7 +131,7 @@ The following table compares the features and functions of Software Restriction
Editing the hash value |
In Windows XP, you could use SRP to provide custom hash values.
Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, not provide the hash value. |
-AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and a SHA2 flat file hash for the rest. |
+AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest. |
Support for different security levels |
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
index 58576ff79e..ce28a56e21 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
@@ -1,5 +1,5 @@
---
-title: Use the AppLocker Windows PowerShell cmdlets (Windows 10)
+title: Use the AppLocker Windows PowerShell cmdlets (Windows)
description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies.
ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Use the AppLocker Windows PowerShell cmdlets
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
index 7895373d6e..3015885de1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
@@ -1,5 +1,5 @@
---
-title: Using Event Viewer with AppLocker (Windows 10)
+title: Using Event Viewer with AppLocker (Windows)
description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker.
ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Using Event Viewer with AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic lists AppLocker events and describes how to use Event Viewer with AppLocker.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
index 5e34495965..79b2485918 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Use Software Restriction Policies and AppLocker policies (Windows 10)
+title: Use Software Restriction Policies and AppLocker policies (Windows)
description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment.
ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Use Software Restriction Policies and AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
index 5e8f5b2efb..b65a70c0fe 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
@@ -1,5 +1,5 @@
---
-title: What Is AppLocker (Windows 10)
+title: What Is AppLocker (Windows)
description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies.
ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# What Is AppLocker?
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
index 77b78c5a84..0975dd70c7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
@@ -1,5 +1,5 @@
---
-title: Windows Installer rules in AppLocker (Windows 10)
+title: Windows Installer rules in AppLocker (Windows)
description: This topic describes the file formats and available default rules for the Windows Installer rule collection.
ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Windows Installer rules in AppLocker
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic describes the file formats and available default rules for the Windows Installer rule collection.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
index 276960c4b0..e4c6caae70 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
@@ -1,5 +1,5 @@
---
-title: Working with AppLocker policies (Windows 10)
+title: Working with AppLocker policies (Windows)
description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies.
ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d
ms.reviewer:
@@ -21,8 +21,13 @@ ms.technology: mde
# Working with AppLocker policies
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
index 67910704f3..74ce2ea9d8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
@@ -1,5 +1,5 @@
---
-title: Working with AppLocker rules (Windows 10)
+title: Working with AppLocker rules (Windows)
description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies.
ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9
ms.reviewer:
@@ -19,8 +19,13 @@ ms.technology: mde
# Working with AppLocker rules
**Applies to**
-- Windows 10
-- Windows Server
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md
index 48dc8c3166..671bd29bf1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Use audit events to create then enforce WDAC policy rules (Windows 10)
+title: Use audit events to create then enforce WDAC policy rules (Windows)
description: Learn how audits allow admins to discover apps, binaries, and scripts that should be added to a WDAC policy, then learn how to switch that WDAC policy from audit to enforced mode.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included.
diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
index 7700137052..706f2e6d6a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Use audit events to create WDAC policy rules (Windows 10)
+title: Use audit events to create WDAC policy rules (Windows)
description: Audits allow admins to discover apps, binaries, and scripts that should be added to the WDAC policy.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included.
diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
index 15639fd8d3..70e5a3a31d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
@@ -1,6 +1,6 @@
---
-title: Configure authorized apps deployed with a WDAC-managed installer (Windows 10)
-description: Explains how to configure a custom Manged Installer.
+title: Configure authorized apps deployed with a WDAC-managed installer (Windows)
+description: Explains about how to configure a custom Manged Installer.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: m365-security
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2019
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager.
@@ -73,7 +77,7 @@ The identity of the managed installer executable(s) is specified in an AppLocker
Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, you can use a text editor to make the changes that are needed to an EXE or DLL rule collection policy, to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO.
-1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability.
+1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability.
```powershell
Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml
diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md
index 9d15cbfcc7..a6fe5ce62e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md
@@ -1,5 +1,5 @@
---
-title: Configure a WDAC managed installer (Windows 10)
+title: Configure a WDAC managed installer (Windows)
description: Explains how to configure a custom Manged Installer.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2019
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled.
There are three primary steps to keep in mind:
@@ -40,7 +44,7 @@ The identity of the managed installer executable(s) is specified in an AppLocker
Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO.
-1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability.
+1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability.
```powershell
Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml
@@ -126,7 +130,7 @@ For example:
In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy.
This can be done by using the [Set-RuleOption cmdlet](/powershell/module/configci/set-ruleoption) with Option 13.
-Below are steps to create a WDAC policy which allows Windows to boot and enables the managed installer option.
+Below are steps to create a WDAC policy that allows Windows to boot and enables the managed installer option.
1. Copy the DefaultWindows_Audit policy into your working folder from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
index 7eabd55187..761ea31822 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
@@ -1,5 +1,5 @@
---
-title: Create a code signing cert for Windows Defender Application Control (Windows 10)
+title: Create a code signing cert for Windows Defender Application Control (Windows)
description: Learn how to set up a publicly-issued code signing certificate, so you can sign catalog files or WDAC policies internally.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,7 +23,11 @@ ms.technology: mde
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md).
@@ -75,7 +79,7 @@ When this certificate template has been created, you must publish it to the CA p
2. Select the WDAC Catalog signing certificate, and then click **OK**.
-Now that the template is available to be issued, you must request one from the computer running Windows 10 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps:
+Now that the template is available to be issued, you must request one from the computer running Windows 10 and Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps:
1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**.
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
index a4d560af0b..40ab4ad3bd 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
@@ -1,5 +1,5 @@
---
-title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows 10)
+title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows)
description: To create a Windows Defender Application Control (WDAC) policy for fixed-workload devices within your organization, follow this guide.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,30 +22,34 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc...
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
-For this example, you must initiate variables to be used during the creation process or use the full file paths in the command.
-Then create the WDAC policy by scanning the system for installed applications.
+This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc.
+
+For this example, you must initiate variables to be used during the creation process or use the full file paths in the command.
+Then create the WDAC policy by scanning the system for installed applications.
The policy file is converted to binary format when it gets created so that Windows can interpret it.
## Overview of the process of creating Windows Defender Application Control policies
A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
-Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
+Optionally, WDAC can align with your software catalog and any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged, or serviced, and managed.
-If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
+If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
> [!NOTE]
-> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.
+> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.
-Each installed software application should be validated as trustworthy before you create a policy.
-We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable.
-Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts.
-You can remove or disable such software on the reference computer.
+Each installed software application should be validated as trustworthy before you create a policy.
+We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable.
+Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts.
+You can remove or disable such software on the reference computer.
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md
index cceb8da77d..0037968837 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md
@@ -1,6 +1,6 @@
---
-title: Create a WDAC policy for fully-managed devices (Windows 10)
-description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+title: Create a WDAC policy for fully managed devices (Windows)
+description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in system core.
keywords: security, malware
ms.topic: conceptual
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -19,29 +19,33 @@ ms.date: 11/20/2019
ms.technology: mde
---
-# Create a WDAC policy for fully-managed devices
+# Create a WDAC policy for fully managed devices
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-This section outlines the process to create a WDAC policy for **fully-managed devices** within an organization. The key difference between this scenario and [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully-managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully-managed devices should ideally run as standard user and only authorized IT pros have administrative access.
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+This section outlines the process to create a WDAC policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access.
> [!NOTE]
-> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs.
+> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs.
As described in [common WDAC deployment scenarios](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices.
**Alice Pena** is the IT team lead tasked with the rollout of WDAC.
-Alice previously created a policy for the organization's lightly-managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and task-workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT.
+Alice previously created a policy for the organization's lightly managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and firstline workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT.
-## Define the "circle-of-trust" for fully-managed devices
+## Define the "circle-of-trust" for fully managed devices
-Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully-managed devices:
+Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully managed devices:
-- All clients are running Windows 10 version 1903 or above;
+- All clients are running Windows 10 version 1903 or above or Windows 11;
- All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune;
> [!NOTE]
@@ -55,15 +59,15 @@ Alice's team develops a simple console application, called *LamnaITInstaller.exe
Based on the above, Alice defines the pseudo-rules for the policy:
-1. **“Windows works”** rules which authorizes:
+1. **“Windows works”** rules that authorize:
- Windows
- WHQL (3rd party kernel drivers)
- Windows Store signed apps
-2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function
+2. **"MEMCM works”** rules that include signer and hash rules for MEMCM components to properly function
3. **Allow Managed Installer** (MEMCM and *LamnaITInstaller.exe* configured as a managed installer)
-The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are:
+The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are:
- Removal of the Intelligent Security Graph (ISG) option; and
- Removal of filepath rules.
@@ -77,7 +81,7 @@ Alice follows these steps to complete this task:
> [!NOTE]
> If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy.
-1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above.
+1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above, or Windows 11.
2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables:
@@ -129,12 +133,12 @@ Alice follows these steps to complete this task:
At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna.
-## Security considerations of this fully-managed policy
+## Security considerations of this fully managed policy
-Alice has defined a policy for Lamna's fully-managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include:
+Alice has defined a policy for Lamna's fully managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include:
- **Users with administrative access**
- Although applying to fewer users, Lamna still allows some IT staff to log in to its fully-managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish.
+ Although applying to fewer users, Lamna still allows some IT staff to log in to its fully managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish.
Possible mitigations:
- Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies.
@@ -160,7 +164,7 @@ Alice has defined a policy for Lamna's fully-managed devices that makes some tra
Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction.
Possible mitigations:
- - Use signed WDAC policies which allow authorized signed supplemental policies only.
+ - Use signed WDAC policies that allow authorized signed supplemental policies only.
- Use a restrictive audit mode policy to audit app usage and augment vulnerability detection.
## Up next
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md
index c4dabcde4c..76199f55b5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md
@@ -1,5 +1,5 @@
---
-title: Create a WDAC policy for lightly-managed devices (Windows 10)
+title: Create a WDAC policy for lightly managed devices (Windows)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
keywords: security, malware
ms.topic: conceptual
@@ -19,29 +19,33 @@ ms.date: 11/15/2019
ms.technology: mde
---
-# Create a WDAC policy for lightly-managed devices
+# Create a WDAC policy for lightly managed devices
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-This section outlines the process to create a WDAC policy for **lightly-managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC managed devices as described in later topics.
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+This section outlines the process to create a WDAC policy for **lightly managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC-managed devices as described in later topics.
> [!NOTE]
-> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs.
+> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs.
As in the [previous topic](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices.
-**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with very loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads.
+**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads.
For the majority of users and devices, Alice wants to create an initial policy that is as relaxed as possible in order to minimize user productivity impact, while still providing security value.
-## Define the "circle-of-trust" for lightly-managed devices
+## Define the "circle-of-trust" for lightly managed devices
-Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly-managed devices, which currently includes most end-user devices:
+Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly managed devices, which currently include most end-user devices:
-- All clients are running Windows 10 version 1903 or above;
+- All clients are running Windows 10 version 1903 and above, or Windows 11;
- All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune;
> [!NOTE]
@@ -53,12 +57,12 @@ Alice identifies the following key factors to arrive at the "circle-of-trust" fo
Based on the above, Alice defines the pseudo-rules for the policy:
-1. **“Windows works”** rules which authorizes:
+1. **“Windows works”** rules that authorize:
- Windows
- WHQL (3rd party kernel drivers)
- Windows Store signed apps
-2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function
+2. **"MEMCM works”** rules which include signer and hash rules for MEMCM components to properly function
3. **Allow Managed Installer** (MEMCM configured as a managed installer)
4. **Allow Intelligent Security Graph (ISG)** (reputation-based authorization)
5. **Admin-only path rules** for the following locations:
@@ -68,14 +72,14 @@ Based on the above, Alice defines the pseudo-rules for the policy:
## Create a custom base policy using an example WDAC base policy
-Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly-managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs.
+Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs.
Alice follows these steps to complete this task:
> [!NOTE]
> If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy.
-1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above.
+1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 and above, or Windows 11.
2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables:
@@ -137,12 +141,12 @@ Alice follows these steps to complete this task:
At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna.
-## Security considerations of this lightly-managed policy
+## Security considerations of this lightly managed policy
In order to minimize user productivity impact, Alice has defined a policy that makes several trade-offs between security and user app flexibility. Some of the trade-offs include:
- **Users with administrative access**
- By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish.
+ By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish.
Possible mitigations:
- Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies.
@@ -164,13 +168,13 @@ In order to minimize user productivity impact, Alice has defined a policy that m
See [security considerations with the Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md#security-considerations-with-the-intelligent-security-graph)
Possible mitigations:
- - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature based rules.
+ - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature-based rules.
- Use a restrictive audit mode policy to audit app usage and augment vulnerability detection.
- **Supplemental policies**
Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction.
Possible mitigations:
- - Use signed WDAC policies which allow authorized signed supplemental policies only.
+ - Use signed WDAC policies that allow authorized signed supplemental policies only.
- Use a restrictive audit mode policy to audit app usage and augment vulnerability detection.
- **FilePath rules**
See [more information about filepath rules](select-types-of-rules-to-create.md#more-information-about-filepath-rules)
@@ -181,5 +185,5 @@ In order to minimize user productivity impact, Alice has defined a policy that m
## Up next
-- [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md)
+- [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md)
- [Prepare to deploy WDAC policies](windows-defender-application-control-deployment-guide.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
index ba2fcb0f9b..bdb0bb25f6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
@@ -1,5 +1,5 @@
---
-title: Deploy catalog files to support Windows Defender Application Control (Windows 10)
+title: Deploy catalog files to support Windows Defender Application Control (Windows)
description: Catalog files simplify running unsigned applications in the presence of a Windows Defender Application Control (WDAC) policy.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,7 +23,11 @@ ms.technology: mde
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Catalog files can be important in your deployment of Windows Defender Application Control (WDAC) if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create WDAC policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by WDAC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
index 33cc699ac1..9ea7cc663a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Use multiple Windows Defender Application Control Policies (Windows 10)
+title: Use multiple Windows Defender Application Control Policies (Windows)
description: Windows Defender Application Control supports multiple code integrity policies for one device.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10 version 1903 and above
-- Windows Server 2022 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Prior to Windows 10 1903, WDAC only supported a single active policy on a system at any given time. This significantly limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios:
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
index f3d496160b..dea3b62b33 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
@@ -1,5 +1,5 @@
---
-title: Deploy WDAC policies via Group Policy (Windows 10)
+title: Deploy WDAC policies via Group Policy (Windows)
description: Windows Defender Application Control (WDAC) policies can easily be deployed and managed with Group Policy. Learn how by following this step-by-step guide.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,11 +22,15 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
> [!NOTE]
-> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, we recommend using an alternative method for policy deployment.
+> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment.
Single-policy format WDAC policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy. The following procedure walks you through how to deploy a WDAC policy called **ContosoPolicy.bin** to a test OU called *WDAC Enabled PCs* by using a GPO called **Contoso GPO Test**.
@@ -61,4 +65,4 @@ To deploy and manage a WDAC policy with Group Policy:
> [!NOTE]
> You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
-7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the WDAC policy.
+7. Close the Group Policy Management Editor, and then restart the Windows test computer. Restarting the computer updates the WDAC policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
index b4cb9a3f05..29fbbe9431 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
@@ -1,5 +1,5 @@
---
-title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows 10)
+title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows)
description: You can use an MDM like Microsoft Intune to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,13 +22,18 @@ ms.technology: mde
**Applies to:**
-- Windows 10
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
You can use a Mobile Device Management (MDM) solution, like Microsoft Endpoint Manager (MEM) Intune, to configure Windows Defender Application Control (WDAC) on client machines. Intune includes native support for WDAC which can be a helpful starting point, but customers may find the available circle-of-trust options too limiting. To deploy a custom policy through Intune and define your own circle of trust, you can configure a profile using Custom OMA-URI. If your organization uses another MDM solution, check with your solution provider for WDAC policy deployment steps.
## Use Intune's built-in policies
-Intune's built-in WDAC support allows you to configure Windows 10 client computers to only run:
+Intune's built-in WDAC support allows you to configure Windows client computers to only run:
- Windows components
- 3rd party hardware and software kernel drivers
@@ -36,7 +41,7 @@ Intune's built-in WDAC support allows you to configure Windows 10 client compute
- [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG)
> [!NOTE]
-> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ as described later in this topic.
+> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic.
> [!NOTE]
> Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP will always request a reboot when applying WDAC policies. You can use Intune's custom OMA-URI feature with the ApplicationControl CSP to deploy your own WDAC policies rebootlessly.
diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md
index 6e4c3d3b7a..3dcca008bc 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md
@@ -1,5 +1,5 @@
---
-title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Endpoint Configuration Manager (MEMCM) (Windows 10)
+title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Endpoint Configuration Manager (MEMCM) (Windows)
description: You can use Microsoft Endpoint Configuration Manager (MEMCM) to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide.
keywords: security, malware
ms.prod: m365-security
@@ -21,13 +21,17 @@ ms.localizationpriority: medium
**Applies to:**
- Windows 10
+- Windows 11
- Windows Server 2016 and above
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
+
You can use Microsoft Endpoint Configuration Manager (MEMCM) to configure Windows Defender Application Control (WDAC) on client machines.
## Use MEMCM's built-in policies
-MEMCM includes native support for WDAC, which allows you to configure Windows 10 client computers with a policy that will only allow:
+MEMCM includes native support for WDAC, which allows you to configure Windows 10 and Windows 11 client computers with a policy that will only allow:
- Windows components
- Microsoft Store apps
diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md
index ca2d5fed65..2212ae92fb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md
@@ -1,5 +1,5 @@
---
-title: Deploy Windows Defender Application Control (WDAC) policies using script (Windows 10)
+title: Deploy Windows Defender Application Control (WDAC) policies using script (Windows)
description: Use scripts to deploy Windows Defender Application Control (WDAC) policies. Learn how with this step-by-step guide.
keywords: security, malware
ms.prod: m365-security
@@ -21,8 +21,12 @@ ms.localizationpriority: medium
**Applies to:**
- Windows 10
+- Windows 11
- Windows Server 2016 and above
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
+
This topic describes how to deploy Windows Defender Application Control (WDAC) policies using script. The instructions below use PowerShell but can work with any scripting host.
> [!NOTE]
diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
index 6cbf4d90fa..ad706276ac 100644
--- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Disable Windows Defender Application Control policies (Windows 10)
+title: Disable Windows Defender Application Control policies (Windows)
description: Learn how to disable both signed and unsigned Windows Defender Application Control policies, within Windows and within the BIOS.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,7 +23,11 @@ ms.technology: mde
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This topic covers how to disable unsigned or signed WDAC policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
index 6c3b04eb5a..5dd1fd73f9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10)
+title: Enforce Windows Defender Application Control (WDAC) policies (Windows)
description: Learn how to switch a WDAC policy from audit to enforced mode.
keywords: security, malware
ms.prod: m365-security
@@ -20,13 +20,17 @@ ms.localizationpriority: medium
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
You should now have one or more WDAC policies broadly deployed in audit mode. You have analyzed events collected from the devices with those policies and you're ready to enforce. Use this procedure to prepare and deploy your WDAC policies in enforcement mode.
> [!NOTE]
-> Some of the steps described in this article only apply to Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs.
+> Some of the steps described in this article only apply to Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs.
## Convert WDAC **base** policy from audit to enforced
diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
index 8457a3a69c..4e249a4f50 100644
--- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
@@ -1,5 +1,5 @@
---
-title: Example Windows Defender Application Control (WDAC) base policies (Windows 10)
+title: Example Windows Defender Application Control (WDAC) base policies (Windows)
description: When creating a WDAC policy for an organization, start from one of the many available example base policies.
keywords: security, malware
ms.topic: article
@@ -23,8 +23,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
When creating policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that can be used, or organizations that use the Device Guard Signing Service can download a starter policy from that service.
diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md
index 0f9af0978c..8e813e308b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md
+++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md
@@ -1,5 +1,5 @@
---
-title: Feature Availability
+title: Windows Defender Application Control Feature Availability
description: Compare WDAC and AppLocker feature availability.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -19,20 +19,24 @@ ms.custom: asr
ms.technology: mde
---
-# WDAC and AppLocker feature availability
+# Windows Defender Application Control and AppLocker feature availability
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. See below to learn more.
| Capability | WDAC | AppLocker |
|-------------|------|-------------|
-| Platform support | Available on Windows 10 | Available on Windows 8+ |
+| Platform support | Available on Windows 10 and Windows 11 | Available on Windows 8+ |
| SKU availability | Cmdlets are available on all SKUs on 1909+ builds. For pre-1909 builds, cmdlets are only available on Enterprise but policies are effective on all SKUs. | Policies deployed through GP are only effective on Enterprise devices. Policies deployed through MDM are effective on all SKUs. |
| Management solutions | - [Intune](./deploy-windows-defender-application-control-policies-using-intune.md) (limited built-in policies or custom policy deployment via OMA-URI)
- [Microsoft Endpoint Manager Configuration Manager (MEMCM)](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) (limited built-in policies or custom policy deployment via Software Distribution)
- [Group Policy](./deploy-windows-defender-application-control-policies-using-group-policy.md)
- PowerShell
| - [Intune](/windows/client-management/mdm/applocker-csp) (custom policy deployment via OMA-URI only)
- MEMCM (custom policy deployment via Software Distribution only)
- [Group Policy](./applocker/determine-group-policy-structure-and-rule-enforcement.md)
- PowerShell
|
| Per-User and Per-User group rules | Not available (policies are device-wide) | Available on Windows 8+ |
-| Kernel mode policies | Available on all Windows 10 versions | Not available |
+| Kernel mode policies | Available on all Windows 10 versions and Windows 11 | Not available |
| Per-app rules | [Available on 1703+](./use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md) | Not available |
| Managed Installer (MI) | [Available on 1703+](./configure-authorized-apps-deployed-with-a-managed-installer.md) | Not available |
| Reputation-Based intelligence | [Available on 1709+](./use-windows-defender-application-control-with-intelligent-security-graph.md) | Not available |
@@ -40,4 +44,4 @@ ms.technology: mde
| Path-based rules | [Available on 1903+.](./select-types-of-rules-to-create.md#more-information-about-filepath-rules) Exclusions are not supported. Runtime user-writeability checks enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. |
| COM object configurability | [Available on 1903+](./allow-com-object-registration-in-windows-defender-application-control-policy.md) | Not available |
| Packaged app rules | [Available on RS5+](./manage-packaged-apps-with-windows-defender-application-control.md) | Available on Windows 8+ |
-| Enforceable file types | - Driver files: .sys
- Executable files: .exe and .com
- DLLs: .dll and .ocx
- Windows Installer files: .msi, .mst, and .msp
- Scripts: .ps1, .vbs, and .js
- Packaged apps and packaged app installers: .appx
| - Executable files: .exe and .com
- [Optional] DLLs: .dll and .ocx
- Windows Installer files: .msi, .mst, and .msp
- Scripts: .ps1, .bat, .cmd, .vbs, and .js
- Packaged apps and packaged app installers: .appx
|
\ No newline at end of file
+| Enforceable file types | - Driver files: .sys
- Executable files: .exe and .com
- DLLs: .dll and .ocx
- Windows Installer files: .msi, .mst, and .msp
- Scripts: .ps1, .vbs, and .js
- Packaged apps and packaged app installers: .appx
| - Executable files: .exe and .com
- [Optional] DLLs: .dll and .ocx
- Windows Installer files: .msi, .mst, and .msp
- Scripts: .ps1, .bat, .cmd, .vbs, and .js
- Packaged apps and packaged app installers: .appx
|
diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
index 4d5cd8178f..2d0ccf9451 100644
--- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
@@ -1,5 +1,5 @@
---
-title: Manage packaged apps with WDAC (Windows 10)
+title: Manage packaged apps with WDAC (Windows)
description: Packaged apps, also known as Universal Windows apps, allow you to control the entire app by using a single Windows Defender Application Control (WDAC) rule.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,7 +23,11 @@ ms.technology: mde
**Applies to:**
- Windows 10
-- Windows Server 2016
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This topic for IT professionals describes concepts and lists procedures to help you manage packaged apps with Windows Defender Application Control (WDAC) as part of your overall application control strategy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
index a3a2084a23..f2561cb90c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
@@ -1,5 +1,5 @@
---
-title: Merge Windows Defender Application Control policies (WDAC) (Windows 10)
+title: Merge Windows Defender Application Control policies (WDAC) (Windows)
description: Learn how to merge WDAC policies as part of your policy lifecycle management.
keywords: security, malware
ms.prod: m365-security
@@ -20,8 +20,12 @@ ms.localizationpriority: medium
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This article shows how to merge multiple policy XML files together and how to merge rules directly into a policy. WDAC deployments often include a few base policies and optional supplemental policies for specific use cases.
@@ -87,7 +91,7 @@ Now that you have your new, merged policy, you can convert and deploy the policy
```
> [!NOTE]
- > In the sample commands above, for policies targeting Windows 10 version 1903+, replace the string "{InsertPolicyID}" with the actual PolicyID GUID (including braces **{ }**) found in your policy XML file. For Windows 10 versions prior to 1903, use the name SiPolicy.p7b for the binary file name.
+ > In the sample commands above, for policies targeting Windows 10 version 1903+ or Windows 11, replace the string "{InsertPolicyID}" with the actual PolicyID GUID (including braces **{ }**) found in your policy XML file. For Windows 10 versions prior to 1903, use the name SiPolicy.p7b for the binary file name.
2. Upload your merged policy XML and the associated binary to the source control solution you are using for your WDAC policies. such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration).
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
index 1bea88acc3..008d041e97 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
@@ -1,5 +1,5 @@
---
-title: Microsoft recommended block rules (Windows 10)
+title: Microsoft recommended block rules (Windows)
description: View a list of recommended block rules, based on knowledge shared between Microsoft and the wider security community.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.date: 08/23/2021
**Applies to:**
-- Windows 10
-- Windows Server 2016 or later
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control.
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
index f85b75d3ad..56ff102873 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
@@ -1,5 +1,5 @@
---
-title: Microsoft recommended driver block rules (Windows 10)
+title: Microsoft recommended driver block rules (Windows)
description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community.
keywords: security, malware, kernel mode, driver
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -21,10 +21,14 @@ ms.date:
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-Microsoft has strict requirements for code running in kernel. Consequently, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're patched and rolled out to the ecosystem in an expedited manner. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy, which is applied to the following sets of devices:
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're patched and rolled out to the ecosystem in an expedited manner. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy, which is applied to the following sets of devices:
- Hypervisor-protected code integrity (HVCI) enabled devices
- Windows 10 in S mode (S mode) devices
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
index c525c8832f..3cd76bde2b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
@@ -20,8 +20,13 @@ ms.localizationpriority: medium
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
This topic covers tips and tricks for admins as well as known issues with WDAC.
Test this configuration in your lab before enabling it in production.
diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
index 12975743d7..0c319af7e6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
+++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
@@ -1,5 +1,5 @@
---
-title: Plan for WDAC policy management (Windows 10)
+title: Plan for WDAC policy management (Windows)
description: Learn about the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control policies.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This topic describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
@@ -49,10 +53,10 @@ To effectively manage WDAC policies, you should store and maintain your policy X
### Set PolicyName, PolicyID, and Version metadata for each policy
-Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system auto-generate a unique ID for the policy.
+Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system autogenerate a unique ID for the policy.
> [!NOTE]
-> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10.
+> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above, or Windows 11. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10.
> PolicyID should be set only once per policy and use different PolicyID's for the audit and enforced mode versions of each policy.
In addition, we recommend using the [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion) cmdlet to increment the policy's internal version number when you make changes to the policy. The version must be defined as a standard four-part version string (e.g. "1.0.0.0").
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 8f9b6ac45d..403aab58d8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -1,6 +1,6 @@
---
-title: Understand Windows Defender Application Control (WDAC) policy rules and file rules (Windows 10)
-description: Learn how WDAC policy rules and file rules can control your Windows 10 computers.
+title: Understand Windows Defender Application Control (WDAC) policy rules and file rules (Windows)
+description: Learn how WDAC policy rules and file rules can control your Windows 10 and Windows 11 computers.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: m365-security
@@ -22,10 +22,14 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted.
+>[!NOTE]
+>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+Windows Defender Application Control (WDAC) can control what runs on Windows 10 and Windows 11 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted.
## Windows Defender Application Control policy rules
@@ -58,10 +62,10 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
| **5 Enabled:Inherit Default Policy** | This option is reserved for future use and currently has no effect. | Yes |
| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and the certificates that are trusted for future policy updates must be identified in the UpdatePolicySigners section. | Yes |
| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | Yes |
-| **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | No |
+| **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and Windows 11 drivers will meet this requirement. | No |
| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | No |
| **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | No |
-| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | No |
+| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows without the proper update may have unintended results. | No |
| **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. | No |
| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | Yes |
| **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | Yes |
diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
index 936314d342..a4f3db57bd 100644
--- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
+++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
@@ -1,5 +1,5 @@
---
-title: Policy creation for common WDAC usage scenarios (Windows 10)
+title: Policy creation for common WDAC usage scenarios (Windows)
description: Develop a plan for deploying Windows Defender Application Control (WDAC) in your organization based on these common scenarios.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,9 +23,13 @@ ms.technology: mde
**Applies to**
- Windows 10
+- Windows 11
- Windows Server 2016 and above
-Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is very common for organizations to have device use cases across each of the categories described.
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is common for organizations to have device use cases across each of the categories described.
## Types of devices
@@ -34,7 +38,7 @@ Typically, deployment of Windows Defender Application Control (WDAC) happens bes
| **Lightly managed devices**: Company-owned, but users are free to install software. Devices are required to run organization's antivirus solution and client management tools. | WDAC can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. |
| **Fully managed devices**: Allowed software is restricted by IT department. Users can request additional software, or install from a list of applications provided by IT department. Examples: locked-down, company-owned desktops and laptops. | An initial baseline WDAC policy can be established and enforced. Whenever the IT department approves additional applications, it will update the WDAC policy and (for unsigned LOB applications) the catalog. WDAC policies are supported by the HVCI service. |
| **Fixed-workload devices**: Perform same tasks every day. Lists of approved applications rarely change. Examples: kiosks, point-of-sale systems, call center computers. | WDAC can be deployed fully, and deployment and ongoing administration are relatively straightforward. After WDAC deployment, only approved applications can run. This is because of protections offered by WDAC. |
-| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a block-list only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. |
+| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a blocklist only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. |
## An introduction to Lamna Healthcare Company
@@ -42,7 +46,7 @@ In the next set of topics, we will explore each of the above scenarios using a f
Lamna Healthcare Company (Lamna) is a large healthcare provider operating in the United States. Lamna employs thousands of people, from doctors and nurses to accountants, in-house lawyers, and IT technicians. Their device use cases are varied and include single-user workstations for their professional staff, shared kiosks used by doctors and nurses to access patient records, dedicated medical devices such as MRI scanners, and many others. Additionally, Lamna has a relaxed, bring-your-own-device policy for many of their professional staff.
-Lamna uses [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) (MEM) in hybrid mode with both Configuration Manager (MEMCM) and Intune. Although they use MEM to deploy many applications, Lamna has always had very relaxed application usage practices: individual teams and employees have been able to install and use any applications they deem necessary for their role on their own workstations. Lamna also recently started to use [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) for better endpoint detection and response.
+Lamna uses [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) (MEM) in hybrid mode with both Configuration Manager (MEMCM) and Intune. Although they use MEM to deploy many applications, Lamna has always had relaxed application usage practices: individual teams and employees have been able to install and use any applications they deem necessary for their role on their own workstations. Lamna also recently started to use [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) for better endpoint detection and response.
> [!NOTE]
> Microsoft Endpoint Configuration Manager was previously known as System Center Configuration Manager.
diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
index 7640970646..ce15020a22 100644
--- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
@@ -1,5 +1,5 @@
---
-title: Understand Windows Defender Application Control policy design decisions (Windows 10)
+title: Understand Windows Defender Application Control policy design decisions (Windows)
description: Understand Windows Defender Application Control policy design decisions.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This topic is for the IT professional and lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
@@ -70,7 +74,7 @@ Traditional Win32 apps on Windows can run without being digitally signed. This p
| Possible answers | Design considerations |
| - | - |
| All apps used in your organization must be signed. | Organizations that enforce [codesigning](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) for all executable code are best-positioned to protect their Windows computers from malicious code execution. WDAC rules can be created to authorize apps and binaries from the organization's internal development teams and from trusted independent software vendors (ISV). |
-| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process, which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. |
+| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process, which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. |
### Are there specific groups in your organization that need customized application control policies?
@@ -79,7 +83,7 @@ Most business teams or departments have specific security requirements that pert
| Possible answers | Design considerations |
| - | - |
| Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally defined base policy.|
-| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|
+| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10 and Windows 11. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|
### Does your IT department have resources to analyze application usage, and to design and manage the policies?
@@ -88,7 +92,7 @@ The time and resources that are available to you to perform the research and ana
| Possible answers | Design considerations |
| - | - |
| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are constructed as simply as possible.|
-| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. |
+| No | Consider a focused and phased deployment for specific groups by using few rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. |
### Does your organization have Help Desk support?
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
index 8e289e4bf3..dae8561c9b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
@@ -1,5 +1,5 @@
---
-title: Use code signing to simplify application control for classic Windows applications (Windows 10)
+title: Use code signing to simplify application control for classic Windows applications (Windows)
description: With embedded signing, your WDAC policies typically do not have to be updated when an app is updated. To set this up, you can choose from a variety of methods.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,12 +22,16 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
This topic covers guidelines for using code signing control classic Windows apps.
-## Reviewing your applications: application signing and catalog files
+## Reviewing your applications: application signing and catalog files
Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a "catalog file" from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed.
@@ -49,20 +53,20 @@ To use catalog signing, you can choose from the following options:
### Catalog files
-Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application.
+Catalog files (which you can create in Windows 10 and Windows 11 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application.
Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries' hash values are updated each time an application is updated, which requires the catalog file to be updated also.
After you have created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files.
> [!NOTE]
-> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT.
+> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, Windows 2016 Server, or Windows Enterprise IoT.
For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md).
## Windows Defender Application Control policy formats and signing
-When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file.
+When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 and Windows 11 Enterprise, along with restrictions on Windows 10 and Windows 11 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file.
We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command.
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
index a34f45e591..73f07b3405 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
@@ -1,5 +1,5 @@
---
-title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
+title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows)
description: You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,11 +22,14 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2019
-- Windows Server 2016
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed.
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed.
## Sign your code integrity policy
Before you get started, be sure to review these best practices:
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
index 498c736696..11d3f0df1e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
@@ -1,6 +1,6 @@
---
-title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10)
-description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
+title: Use signed policies to protect Windows Defender Application Control against tampering (Windows)
+description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10 and Windows 11.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: m365-security
@@ -22,11 +22,14 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
-Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies.
+Signed WDAC policies give organizations the highest level of malware protection available in Windows. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies.
Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
index 9ffbd067e1..22a1c3c03a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
@@ -1,5 +1,5 @@
---
-title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10)
+title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows)
description: WDAC policies can be used not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
As of Windows 10, version 1703, you can use WDAC policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser):
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
index d9b739c0ae..22c3b5e232 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
@@ -1,5 +1,5 @@
---
-title: Authorize reputable apps with the Intelligent Security Graph (ISG) (Windows 10)
+title: Authorize reputable apps with the Intelligent Security Graph (ISG) (Windows)
description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -22,8 +22,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
Application control can be difficult to implement in organizations that don't deploy and manage applications through an IT-managed system. In such environments, users can acquire the applications they want to use for work, making it hard to build an effective application control policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md
index ce2acde0e8..e8557445d0 100644
--- a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md
+++ b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md
@@ -23,14 +23,18 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-Windows 10 includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker.
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+Windows 10 and Windows 11 include two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker.
## Windows Defender Application Control
-WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows 10 clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC).
+WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC).
WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on:
@@ -45,9 +49,9 @@ Note that prior to Windows 10 version 1709, Windows Defender Application Control
### WDAC System Requirements
-WDAC policies can be created on any client edition of Windows 10 build 1903+, or on Windows Server 2016 and above.
+WDAC policies can be created on any client edition of Windows 10 build 1903+, or Windows 11, or on Windows Server 2016 and above.
-WDAC policies can be applied to devices running any edition of Windows 10, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition, or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10.
+WDAC policies can be applied to devices running any edition of Windows 10, Windows 11, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 and Windows 11 Enterprise edition, or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10.
For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md
index 4915d3faea..b0f068d8b7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md
@@ -22,8 +22,13 @@ ms.technology: mde
# Creating a new Base Policy with the Wizard
**Applies to**
-- Windows 10
-- Windows Server 2016 and above
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start with a template policy and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules.
@@ -63,7 +68,7 @@ A description of each policy rule, beginning with the left-most column, is provi
|**[Hypervisor-protected code integrity (HVCI)](../device-guard/enable-virtualization-based-protection-of-code-integrity.md)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.|
| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). |
| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. |
-| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. |
+| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows–compatible driver must be WHQL certified. |
| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. |
| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. |
| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. |
@@ -82,7 +87,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru
| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. |
| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). |
| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.|
-| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. |
+| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement. |

diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md
index 5f96c11702..f11d86f9a7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md
@@ -22,12 +22,17 @@ ms.technology: mde
# Creating a new Supplemental Policy with the Wizard
**Applies to**
-- Windows 10
-- Windows Server 2016 and above
-Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute.
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules.
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute.
+
+Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules.
## Expanding a Base Policy
diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md
index 09c88d84aa..d696659c2a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md
@@ -22,8 +22,13 @@ ms.technology: mde
# Editing existing base and supplemental WDAC policies with the Wizard
**Applies to**
-- Windows 10
-- Windows Server 2016 and above
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md
index e1581cb011..4cdeb72f21 100644
--- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md
+++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md
@@ -23,14 +23,18 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
-The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical.
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
+The Windows Defender Application Control (WDAC) policy Wizard is an open-source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects with security, and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical.
## Downloading the application
-The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit).
+The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit).
**Supported Clients**
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
index ab280eb0bc..40512b4dda 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
@@ -1,5 +1,5 @@
---
-title: Deploying Windows Defender Application Control (WDAC) policies (Windows 10)
+title: Deploying Windows Defender Application Control (WDAC) policies (Windows)
description: Learn how to plan and implement a WDAC deployment.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,8 +23,12 @@ ms.technology: mde
**Applies to**
- Windows 10
+- Windows 11
- Windows Server 2016 and above
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
You should now have one or more WDAC policies ready to deploy. If you haven't yet completed the steps described in the [WDAC Design Guide](windows-defender-application-control-design-guide.md), do so now before proceeding.
## Plan your deployment
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
index 0f0e3e388f..57db67bee8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
@@ -1,6 +1,6 @@
---
-title: Windows Defender Application Control design guide (Windows 10)
-description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows 10 devices.
+title: Windows Defender Application Control design guide (Windows)
+description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows devices.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: m365-security
@@ -22,19 +22,24 @@ ms.technology: mde
# Windows Defender Application Control design guide
**Applies to**
-- Windows 10
+
+- Windows 10
+- Windows 11
- Windows Server 2016 and above
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization.
## Plan for success
-A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be very successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning:
+A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning:
- Executive sponsorship and organizational buy-in is in place.
- There is a clear **business** objective for using application control and it is not being planned as a purely technical problem from IT.
- The organization has a plan to handle potential helpdesk support requests for users who are blocked from running some apps.
-- The organization has considered where application control can be most useful (e.g. securing sensitive workloads or business functions) and also where it may be difficult to achieve (e.g. developer workstations).
+- The organization has considered where application control can be most useful (for example, securing sensitive workloads or business functions) and also where it may be difficult to achieve (for example, developer workstations).
Once these business factors are in place, you are ready to begin planning your WDAC deployment. The following topics can help guide you through your planning process.
@@ -46,6 +51,6 @@ Once these business factors are in place, you are ready to begin planning your W
| [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. |
| [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. |
| [Policy creation for common WDAC usage scenarios](types-of-devices.md) | This set of topics outlines common use case scenarios and helps you begin to develop a plan for deploying WDAC in your organization. |
-| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit and merge WDAC policies. |
+| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit, and merge WDAC policies. |
After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
index 8a7fec062e..31c5d1fe8e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
@@ -1,5 +1,5 @@
---
-title: Managing and troubleshooting Windows Defender Application Control policies (Windows 10)
+title: Managing and troubleshooting Windows Defender Application Control policies (Windows)
description: Gather information about how your deployed Windows Defender Application Control policies are behaving.
keywords: security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
@@ -23,8 +23,12 @@ ms.technology: mde
**Applies to**
- Windows 10
+- Windows 11
- Windows Server 2016 and above
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
+
After designing and deploying your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they are not behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature.
## WDAC Events Overview
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
index bbf2800ac4..abe51d1188 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
@@ -23,8 +23,12 @@ ms.technology: mde
**Applies to:**
-- Windows 10
-- Windows Server 2016 and above
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md).
With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks.
@@ -37,7 +41,7 @@ Application control is a crucial line of defense for protecting enterprises give
> [!NOTE]
> Although application control can significantly harden your computers against malicious code, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
-Windows 10 includes two technologies that can be used for application control depending on your organization's specific scenarios and requirements:
+Windows 10 and Windows 11 include two technologies that can be used for application control depending on your organization's specific scenarios and requirements:
- **Windows Defender Application Control**; and
- **AppLocker**
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md
index 1ea2225ff6..40ce6c2dea 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md
@@ -1,6 +1,6 @@
---
title: Windows Sandbox architecture
-description:
+description: Windows Sandbox architecture
ms.prod: m365-security
audience: ITPro
author: dansimp
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
index 6eb53f8e15..1f1a23bd49 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
@@ -1,6 +1,6 @@
---
title: Windows Sandbox configuration
-description:
+description: Windows Sandbox configuration
ms.prod: m365-security
audience: ITPro
author: dansimp
@@ -16,7 +16,7 @@ ms.technology: mde
# Windows Sandbox configuration
-Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the `.wsb` file extension.
+Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or Windows 11. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the `.wsb` file extension.
A configuration file enables the user to control the following aspects of Windows Sandbox:
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
index 869b04185e..0fec75ee34 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
@@ -1,6 +1,6 @@
---
title: Windows Sandbox
-description:
+description: Windows Sandbox overview
ms.prod: m365-security
audience: ITPro
author: dansimp
@@ -36,7 +36,7 @@ The following video provides an overview of Windows Sandbox.
## Prerequisites
-- Windows 10 Pro, Enterprise or Education build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*)
+- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Windows Home edition*)
- AMD64 architecture
- Virtualization capabilities enabled in BIOS
- At least 4 GB of RAM (8 GB recommended)
@@ -45,7 +45,7 @@ The following video provides an overview of Windows Sandbox.
## Installation
-1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or later.
+1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or Windows 11.
2. Enable virtualization on the machine.
| | |