diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index c0b98a40d3..bcb74dbbbd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -10,6 +10,26 @@ ## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md) +### [Use WDAC with the Microsoft Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md) +### [Use WDAC with a managed installer](use-windows-defender-application-control-with-managed-installer.md) +### [Use WDAC with custom policies](use-windows-defender-application-control-with-custom policies.md) +#### [Create an initial default policy](create-initial-default-policy.md) +##### [Microsoft recommended block rules](recommended-block-rules.md) +### [Audit WDAC policies](audit-windows-defender-application-control-policies.md) +### [Merge WDAC policies](merge-windows-defender-application-control-policies.md) +### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md) +### [Deploy WDAC policies](deploy-windows-defender-application-control-policies.md) +#### [Deploy WDAC policies by using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md) +#### [Deploy Windows Defender Application Control policies by using System Center Configuration Manager](deploy-windows-defender-application-control-policies-using-sccm.md) +#### [Deploy Windows Defender Application Control policies by using Microsoft Intune](deploy-windows-defender-application-control-policies-using-intune.md) +### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) +#### [Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) +#### [Optional: Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) +#### [Deploy catalog files to support WDAC](deploy-catalog-files-to-support-windows-defender-application-control.md) +### [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md) +### [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md) +### [Use signed policies to protect Windows Defender Application Control against tampering](use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md) + ## [Windows Defender Application Control and AppLocker](windows-defender-application-control-and-applocker.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md new file mode 100644 index 0000000000..1f5c71d636 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -0,0 +1,19 @@ +--- +title: Audit Windows Defender Application Control (WDAC) policies (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Audit Windows Defender Application Control policies + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md new file mode 100644 index 0000000000..17ecc59ac3 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -0,0 +1,18 @@ +--- +title: Create a code signing cert for Windows Defender Application Control (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Optional: Create a code signing cert for Windows Defender Application Control + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md new file mode 100644 index 0000000000..a756c642b8 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -0,0 +1,19 @@ +--- +title: Create an initial default policy (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Create an initial default policy + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md new file mode 100644 index 0000000000..5a8784f225 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -0,0 +1,18 @@ +--- +title: Deploy catalog files to support Windows Defender Application Control (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Deploy catalog files to support Windows Defender Application Control + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md new file mode 100644 index 0000000000..60df195494 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -0,0 +1,18 @@ +--- +title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Deploy Windows Defender Application Control policies by using Group Policy + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md new file mode 100644 index 0000000000..f60f032426 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -0,0 +1,18 @@ +--- +title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Deploy Windows Defender Application Control policies by using Microsoft Intune + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-sccm.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-sccm.md new file mode 100644 index 0000000000..fe7025dd20 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-sccm.md @@ -0,0 +1,18 @@ +--- +title: Deploy Windows Defender Application Control (WDAC) policies by using System Center Configuration Manager (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Deploy Windows Defender Application Control policies by using System Center Configuration Manager + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies.md index 1f3710586e..b228f4b3c0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jsuther1974 -ms.date: 02/08/2018 +ms.date: 02/28/2018 --- # Deploy Windows Defender Application Control Policies diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md new file mode 100644 index 0000000000..112dfa735b --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -0,0 +1,19 @@ +--- +title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Enforce Windows Defender Application Control policies + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md new file mode 100644 index 0000000000..413d4e1dff --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md @@ -0,0 +1,19 @@ +--- +title: Manage packaged apps with Windows Defender Application Control (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Manage packaged apps with Windows Defender Application Control + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md new file mode 100644 index 0000000000..f1bd040f42 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -0,0 +1,19 @@ +--- +title: Merge Windows Defender Application Control (WDAC) policies (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Merge Windows Defender Application Control policies + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/recommended-block-rules .md b/windows/security/threat-protection/windows-defender-application-control/recommended-block-rules .md new file mode 100644 index 0000000000..55a5d64bb4 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/recommended-block-rules .md @@ -0,0 +1,19 @@ +--- +title: Microsoft recommended block rules (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Microsoft recommended block rules + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md new file mode 100644 index 0000000000..d7707d1775 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -0,0 +1,19 @@ +--- +title: Use code signing to simplify application control for classic Windows applications (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use code signing to simplify application control for classic Windows applications + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md new file mode 100644 index 0000000000..fd0fd8af09 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -0,0 +1,18 @@ +--- +title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jsuther1974 +ms.date: 02/28/2018 +--- + +# Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md new file mode 100644 index 0000000000..f389192d1a --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -0,0 +1,19 @@ +--- +title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use signed policies to protect Windows Defender Application Control against tampering + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md new file mode 100644 index 0000000000..b8fc4f0261 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md @@ -0,0 +1,19 @@ +--- +title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules + +**Applies to:** + +- Windows 10 +- Windows Server 2016 \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-custom policies.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-custom policies.md new file mode 100644 index 0000000000..78f7e8efd4 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-custom policies.md @@ -0,0 +1,19 @@ +--- +title: Use Windows Defender Application Control (WDAC) with custom policies (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use Windows Defender Application Control (WDAC) with custom policies + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md new file mode 100644 index 0000000000..1d3bca849e --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -0,0 +1,19 @@ +--- +title: Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md new file mode 100644 index 0000000000..ed47945aaf --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -0,0 +1,19 @@ +--- +title: Use Windows Defender Application Control (WDAC) with a managed installer (Windows 10) +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: jsuther1974 +ms.date: 02/27/2018 +--- + +# Use Windows Defender Application Control (WDAC) with a managed installer + +**Applies to:** + +- Windows 10 +- Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index f85125b2ca..dfdd26ca1a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -5,8 +5,8 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high -author: brianlic-msft -ms.date: 10/20/2017 +author: jsuther1974 +ms.date: 02/27/2018 --- # Planning and getting started on the Windows Defender Application Control deployment process diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index 74adeafb06..330df53122 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -6,8 +6,9 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +ms.localizationpriority: high author: jsuther1974 -ms.date: 01/24/2018 +ms.date: 02/27/2018 --- # Windows Defender Application Control