From ec31357472af9ebee6d163a162a7e44293e46ffc Mon Sep 17 00:00:00 2001
From: John Tobin <v-jotob@microsoft.com>
Date: Thu, 14 Sep 2017 09:59:08 -0700
Subject: [PATCH] Add dbghost and dbgsvc to block list

---
 .../device-guard/deploy-code-integrity-policies-steps.md  | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
index 9f7bef9162..be6f4de127 100644
--- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
+++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md
@@ -36,6 +36,8 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
 - bginfo.exe<sup>[1]</sup> 
 - cdb.exe
 - csi.exe
+- dbghost.exe
+- dbgsvc.exe
 - dnx.exe
 - fsi.exe
 - fsiAnyCpu.exe
@@ -110,7 +112,9 @@ Microsoft recommends that you block the following Microsoft-signed applications
     <Deny  ID="ID_DENY_WINDBG"        FriendlyName="windbg.exe"         FileName="windbg.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
     <Deny  ID="ID_DENY_MSBUILD"       FriendlyName="MSBuild.exe"        FileName="MSBuild.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
     <Deny  ID="ID_DENY_CSI"           FriendlyName="csi.exe"            FileName="csi.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
-    <Deny  ID="ID_DENY_DNX"           FriendlyName="dnx.exe"            FileName="dnx.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
+    <Deny  ID="ID_DENY_DBGHOST"       FriendlyName="dbghost.exe"       FileName="DBGHOST.Exe" MinimumFileVersion = "2.3.0.0" /> 
+    <Deny  ID="ID_DENY_DBGSVC"        FriendlyName="dbgsvc.exe"         FileName="DBGSVC.Exe" MinimumFileVersion = "2.3.0.0" />    
+    <Deny  ID="ID_DENY_DNX"           FriendlyName="dnx.exe"            FileName="dnx.Exe" MinimumFileVersion = "65535.65535.65535.65535" />   
     <Deny  ID="ID_DENY_RCSI"          FriendlyName="rcsi.exe"           FileName="rcsi.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
     <Deny  ID="ID_DENY_NTSD"          FriendlyName="ntsd.exe"           FileName="ntsd.Exe" MinimumFileVersion = "65535.65535.65535.65535" />
     <Deny  ID="ID_DENY_LXSS"          FriendlyName="LxssManager.dll"    FileName="LxssManager.dll" MinimumFileVersion = "65535.65535.65535.65535" />
@@ -177,6 +181,8 @@ Microsoft recommends that you block the following Microsoft-signed applications
           <FileRuleRef RuleID="ID_DENY_WINDBG"/>
           <FileRuleRef RuleID="ID_DENY_MSBUILD"/>
           <FileRuleRef RuleID="ID_DENY_CSI"/>
+          <FileRuleRef RuleID="ID_DENY_DBGHOST"/>
+          <FileRuleRef RuleID="ID_DENY_DBGSVC"/>
           <FileRuleRef RuleID="ID_DENY_DNX"/>
           <FileRuleRef RuleID="ID_DENY_RCSI"/>
           <FileRuleRef RuleID="ID_DENY_NTSD"/>