diff --git a/education/windows/tutorial-deploy-apps-winse/create-policies.md b/education/windows/tutorial-deploy-apps-winse/create-policies.md index 0ae09cc739..943f0ba810 100644 --- a/education/windows/tutorial-deploy-apps-winse/create-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/create-policies.md @@ -153,7 +153,7 @@ Using a WDAC supplemental policy instead, allows you to have more control over w To allow apps to run by setting their installers as managed installers, follow the guidance here: --> -Additional AppLocker policies work by configuring other apps to be *managed installers*. However, since anything downloaded or installed by a managed installer is trusted to run, it creates a significant security risk. For example, if the executable for a third-party browser is set as a managed installer, anything downloaded from that browser will be allowed to run.\ +Additional AppLocker policies work by configuring other apps to be *managed installers*. However, since anything downloaded or installed by a managed installer is trusted to run, it creates a significant security risk. For example, if the executable for a third-party browser is set as a managed installer, anything downloaded from that browser will be allowed to run. To allow apps to run by setting their installers as managed installers, follow the guidance here: diff --git a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md index fea0597b67..6b3dbc20ca 100644 --- a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md +++ b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md @@ -11,12 +11,22 @@ appliesto: The following table lists common app deployment issues on Windows 11 SE, and options to resolve them: +| **Problem** | **Potential solution** | +|---|---| +| **App hasn't installed** |
  • Check the type of app:
  • It's possible the app is trying to execute a blocked binary. Check the AppLocker and CodeIntegrity logs in the Event Viewer and verify if any executables related to the app are blocked. If so, you'll need to write a supplemental policy to support the app
  • Check the Intune Management Extension logs to see if there was an attempt to install your app
  • | +| **App has problems when running** | It's possible the app is trying to execute a blocked binary
    Check the **AppLocker** and **CodeIntegrity** logs in Event Viewer to see if any executables related to the app are being blocked. If so, you'll need to write a supplemental policy to support the app. | +| **My supplemental policy hasn't deployed** |
  • Your XML policy is malformed. Double-check to see if all markup is tagged correctly
  • Check that your policy is correctly applied| + + + ## AppLocker policy validation > [!NOTE] > The validation process described below requires the deployment of a PowerShell script from Intune to the Windows SE devices. This script will be used to query the AppLocker policy and validate that the policy is configured correctly. The script will also be used to validate the AppLocker service status. -You can query the existing AppLocker policy via PowerShell running from a device. +You can query the existing AppLocker policy via PowerShell. ```PowerShell get-applockerpolicy -xml -effective