Merge pull request #7502 from jsuther1974/WDAC-Docs

Clarify managed installer and ISG technical reference

.openpublishing.redirection.json

@@ -420,6 +420,11 @@
       "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering",
       "redirect_document_id": false
     },
+    {
+      "source_path": "windows/security/threat-protection/windows-defender-application-control/citool-commands.md",
+      "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands",
+      "redirect_document_id": false
+    },
     {
       "source_path": "devices/hololens/hololens-whats-new.md",
       "redirect_url": "/hololens/hololens-release-notes",

windows/security/threat-protection/windows-defender-application-control/TOC.yml

@@ -87,8 +87,6 @@
       href: merge-windows-defender-application-control-policies.md
     - name: Enforce WDAC policies
       href: enforce-windows-defender-application-control-policies.md
-    - name: Managing WDAC Policies with CI Tool
-      href: citool-commands.md
     - name: Use code signing to simplify application control for classic Windows applications
       href: use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
       items:
@@ -117,6 +115,8 @@
       href: operations/known-issues.md
     - name: Managed installer and ISG technical reference and troubleshooting guide
       href: configure-wdac-managed-installer.md
+    - name: Managing WDAC Policies with CI Tool
+      href: operations/citool-commands.md
 - name: WDAC AppId Tagging guide
   href: AppIdTagging/windows-defender-application-control-appid-tagging-guide.md
   items:

windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md

@@ -11,10 +11,10 @@ ms.localizationpriority: medium
 audience: ITPro
 ms.collection: M365-security-compliance
 author: jsuther1974
-ms.reviewer: isbrahm
+ms.reviewer: jogeurte
 ms.author: vinpa
 manager: aaroncz
-ms.date: 08/14/2020
+ms.date: 11/11/2022
 ms.technology: itpro-security
 ---
 
@@ -29,21 +29,25 @@ ms.technology: itpro-security
 >[!NOTE]
 >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Application Control feature availability](feature-availability.md).
 
-## Using fsutil to query SmartLocker EA
+## Enabling managed installer and Intelligent Security Graph (ISG) logging events
 
-Customers using Windows Defender Application Control (WDAC) with Managed Installer (MI) or Intelligent Security Graph (ISG) enabled can use fsutil to determine whether a file was allowed to run by one of these features. This verification can be done by querying the Extended Attributes (EAs) on a file using fsutil and looking for the KERNEL.SMARTLOCKER.ORIGINCLAIM EA. The presence of this EA indicates that either MI or ISG allowed the file to run. This EA's presence can be used in conjunction with enabling the MI and ISG logging events.
+Refer to [Understanding Application Control Events](event-id-explanations.md#diagnostic-events-for-intelligent-security-graph-isg-and-managed-installer-mi) for information on enabling optional managed installer diagnostic events.
+
+## Using fsutil to query extended attributes for Managed Installer (MI)
+
+Customers using Windows Defender Application Control (WDAC) with Managed Installer (MI) enabled can use fsutil.exe to determine whether a file was created by a managed installer process. This verification is done by querying the Extended Attributes (EAs) on a file using fsutil.exe and looking for the KERNEL.SMARTLOCKER.ORIGINCLAIM EA. Then, you can use the data from the first row of output to identify if the file was created by a managed installer. For example, let's look at the fsutil.exe output for a file called application.exe:
 
 **Example:**
 
 ```powershell
-fsutil file queryEA C:\Users\Temp\Downloads\application.exe
+fsutil.exe file queryEA C:\Users\Temp\Downloads\application.exe
 
 Extended Attributes (EA) information for file C:\Users\Temp\Downloads\application.exe:
 
 Ea Buffer Offset: 410
 Ea Name: $KERNEL.SMARTLOCKER.ORIGINCLAIM
 Ea Value Length: 7e
-0000: 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
+0000: 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ................
 0010: b2 ff 10 66 bc a8 47 c7 00 d9 56 9d 3d d4 20 2a ...f..G...V.=. *
 0020: 63 a3 80 e2 d8 33 8e 77 e9 5c 8d b0 d5 a7 a3 11 c....3.w.\......
 0030: 83 00 00 00 00 00 00 00 5c 00 00 00 43 00 3a 00 ........\...C.:.
@@ -53,40 +57,63 @@ Ea Value Length: 7e
 0070: 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 i.c.a.t.i.o.n..e.x.e
 ```
 
-## Enabling managed installer logging events
+From the output shown above, find the first row of data labeled "0000:", which is then followed by 16 two-character sets. Every four sets form a group known as a ULONG. The two-character set at the front of the first ULONG will always be "01" as shown here:
 
-Refer to [Understanding Application Control Events](event-id-explanations.md#diagnostic-events-for-intelligent-security-graph-isg-and-managed-installer-mi) for information on enabling optional managed installer diagnostic events.
+0000: **`01` 00 00 00** 00 00 00 00 00 00 00 00 01 00 00 00
 
-## Deploying the Managed Installer rule collection
+If there is "00" in the fifth position of the output (the start of the second ULONG), that indicates the EA is related to managed installer:
 
-Once you've completed configuring your chosen Managed Installer, by specifying which option to use in the AppLocker policy, enabling the service enforcement of it, and by enabling the Managed Installer option in a WDAC policy, you'll need to deploy it.
+0000: 01 00 00 00 **`00` 00 00 00** 00 00 00 00 01 00 00 00
 
-1. Use the following command to deploy the policy.
+Finally, the two-character set in the ninth position of the output (the start of the third ULONG) indicates whether the file was created by a process running as managed installer. A value of "00" means the file was directly written by a managed installer process and will run if your WDAC policy trusts managed installers.
 
-   ```powershell
-   $policyFile=
-   @"
-   Raw_AppLocker_Policy_XML
-   "@
-   Set-AppLockerPolicy -XmlPolicy $policyFile -Merge -ErrorAction SilentlyContinue
+0000: 01 00 00 00 00 00 00 00 **`00` 00 00 00** 01 00 00 00
+
+If instead the starting value for the third ULONG is "02", then that indicates a "child of child". "Child of child" is set on any files created by something that was installed by a managed installer. But, the file was created **after** the managed installer completed its work. So this file **wouldn't** be allowed to run unless there's some other rule in your policy to allow it.
+
+In rarer cases, you may see other values in this position, but that will also run if your policy trusts managed installer.
+
+## Using fsutil to query extended attributes for Intelligent Security Graph (ISG)
+
+When an installer runs that has good reputation according to the ISG, the files that the installer writes to disk will inherit the reputation from the installer. These files with ISG inherited trust will also have the KERNEL.SMARTLOCKER.ORIGINCLAIM EA set as described above for managed installers. You can identify that the EA was created by the ISG by looking for the value "01" in the fifth position of the output (the start of the second ULONG) from fsutil:
+
+0000: 01 00 00 00 **`01` 00 00 00** 00 00 00 00 01 00 00 00
+
+## More troubleshooting steps for Managed Installer and ISG
+
+Both managed installer and the ISG depend on AppLocker to provide some functionality. Use the following steps to confirm that AppLocker is configured and running correctly.
+
+1. Check that AppLocker services are running. From an elevated PowerShell window, run the following and confirm the STATE shows as RUNNING for both appidsvc and AppLockerFltr:
+
+    ```powershell
+    sc.exe query appidsvc
+        SERVICE_NAME: appidsvc
+        TYPE               : 30  WIN32
+        STATE              : 4  RUNNING
+                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
+        WIN32_EXIT_CODE    : 0  (0x0)
+        SERVICE_EXIT_CODE  : 0  (0x0)
+        CHECKPOINT         : 0x0
+        WAIT_HINT          : 0x0
+    sc.exe query AppLockerFltr
+        SERVICE_NAME: applockerfltr
+        TYPE               : 1  KERNEL_DRIVER
+        STATE              : 4  RUNNING
+                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
+        WIN32_EXIT_CODE    : 0  (0x0)
+        SERVICE_EXIT_CODE  : 0  (0x0)
+        CHECKPOINT         : 0x0
+        WAIT_HINT          : 0x0
    ```
 
-2. Verify Deployment of the ruleset was successful
+    If not, run *appidtel start* from the elevated PowerShell window and check again.
+
+2. For managed installer, check for AppCache.dat and other *.AppLocker files created under %windir%\System32\AppLocker. There should minimally be a ".AppLocker" file created for each of EXE, DLL, and MANAGEDINSTALLER rule collections. If you don't see these files created, proceed to the next step to confirm the AppLocker policy has been correctly applied.
+
+3. For managed installer troubleshooting, check that the AppLocker effective policy is correct. From an elevated PowerShell window:
 
    ```powershell
-   Get-AppLockerPolicy -Local
-   
-   Version RuleCollections RuleCollectionTypes
-   ------- --------------- -------------------
-   1 {0, 0, 0, 0...} {Appx, Dll, Exe, ManagedInstaller...}
+   Get-AppLockerPolicy -Effective -XML > $env:USERPROFILE\Desktop\AppLocker.xml
    ```
 
-   Verify the output shows the ManagedInstaller rule set.
-
-3. Get the policy XML (optional) using PowerShell:
-
-   ```powershell
-   Get-AppLockerPolicy -Effective -Xml -ErrorVariable ev -ErrorAction SilentlyContinue
-   ```
-
-   This command will show the raw XML to verify the individual rules that were set.
+   Then open the XML file created and confirm it contains the rules you expect. In particular, the policy should include at least one rule for each of the EXE, DLL, and MANAGEDINSTALLER RuleCollections. The RuleCollections can either be set to AuditOnly or Enabled. Additionally, the EXE and DLL RuleCollections must include the RuleCollectionExtensions configuration as shown in [Automatically allow apps deployed by a managed installer with Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls).