From cc37b63be7709919d56e09cc61e693416505dfae Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Tue, 6 Sep 2022 11:14:14 -0600 Subject: [PATCH 01/23] Update .openpublishing.redirection.json redirect_url may not be site relative in line 1190', fixed - Absolute with typo 'redirect_url may not be site relative in line 6820', fixed -Del md 'redirect_url may not be site relative in line 14405', fixed - Del md 'redirect_url may not be site relative in line 14410', fixed - Del md 'redirect_url may not be site relative in line 19435', fixed - Del md --- .openpublishing.redirection.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index afe30ff75b..14cf800f1e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1187,7 +1187,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", - "redirect_url": "hhttps://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_url": "/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false }, { @@ -6817,7 +6817,7 @@ }, { "source_path": "windows/manage/waas-wufb-intune.md", - "redirect_url": "/windows/deployment/update/waas-wufb-intune.md", + "redirect_url": "/windows/deployment/update/waas-wufb-intune", "redirect_document_id": false }, { @@ -14402,12 +14402,12 @@ }, { "source_path": "windows/manage/sign-up-windows-store-for-business.md", - "redirect_url": "/microsoft-store/index.md", + "redirect_url": "/microsoft-store/index", "redirect_document_id": false }, { "source_path": "store-for-business/sign-up-windows-store-for-business.md", - "redirect_url": "/microsoft-store/index.md", + "redirect_url": "/microsoft-store/index", "redirect_document_id": false }, { @@ -19432,7 +19432,7 @@ }, { "source_path": "windows/security/threat-protection/intelligence/rootkits-malware.md", - "redirect_url": "/microsoft-365/security/intelligence/rootkits-malware.md", + "redirect_url": "/microsoft-365/security/intelligence/rootkits-malware", "redirect_document_id": false }, { From 2396421384b18415bf84e01f85d324eb21c45ead Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Mon, 12 Sep 2022 12:11:59 -0600 Subject: [PATCH 02/23] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 14cf800f1e..22d9ab9ea4 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -7267,7 +7267,7 @@ }, { "source_path": "windows/manage/application-development-for-windows-as-a-service.md", - "redirect_url": "https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service", + "redirect_url": "windows/uwp/updates-and-versions/application-development-for-windows-as-a-service", "redirect_document_id": false }, { From dcb84bc418431aa1c1de0172e1210e91e4b65d27 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Mon, 19 Sep 2022 13:32:39 -0600 Subject: [PATCH 03/23] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 22d9ab9ea4..db6d1b6b08 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -7447,7 +7447,7 @@ }, { "source_path": "windows/plan/chromebook-migration-guide.md", - "redirect_url": "edu/windows/chromebook-migration-guide", + "redirect_url": "education/windows/chromebook-migration-guide", "redirect_document_id": false }, { From 9b50493710bd983e50927d6ba0b1dce7efaaffb0 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Fri, 4 Nov 2022 14:36:34 -0700 Subject: [PATCH 04/23] Various updates to docs to get them up-to-date. --- .../example-wdac-base-policies.md | 19 ++++++++++-- .../feature-availability.md | 30 +++++++++---------- ...defender-application-control-management.md | 18 +++++------ ...l-specific-plug-ins-add-ins-and-modules.md | 21 ++++++------- 4 files changed, 49 insertions(+), 39 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md index 8ae20cf798..2e172ef502 100644 --- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md @@ -15,7 +15,7 @@ author: jsuther1974 ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 08/05/2022 +ms.date: 11/02/2022 ms.technology: itpro-security --- @@ -40,7 +40,20 @@ When you create policies for use with Windows Defender Application Control (WDAC | **AllowMicrosoft.xml** | This example policy is available in audit mode. It includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies | | **AllowAll.xml** | This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies | | **AllowAll_EnableHVCI.xml** | This example policy can be used to enable [memory integrity](https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also known as hypervisor-protected code integrity) using Windows Defender Application Control. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies | -| **DenyAllAudit.xml** | ***Warning: May cause long boot time on Windows Server 2019.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies | +|-------------------------|---------------------------------------------------------------|--------| +| **DefaultWindows_\*.xml** | This example policy is available in both audit and enforced mode. It includes rules to allow Windows, third-party hardware and software kernel drivers, and Windows Store apps. Used as the basis for all [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) policies. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_\*.xml
%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\DefaultWindows_Audit.xml | +| **AllowMicrosoft.xml** | This example policy is available in audit mode. It includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml
%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\AllowMicrosoft.xml | +| **AllowAll.xml** | This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml | +| **AllowAll_EnableHVCI.xml** | This example policy can be used to enable [memory integrity](https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also known as hypervisor-protected code integrity) using WDAC. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll_EnableHVCI.xml | +| **DenyAllAudit.xml** | ***Warning: May cause long boot time on Windows Server 2019.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml | | **Device Guard Signing Service (DGSS) DefaultPolicy.xml** | This example policy is available in audit mode. It includes the rules from DefaultWindows and adds rules to trust apps signed with your organization-specific certificates issued by the DGSS. | [Device Guard Signing Service NuGet Package](https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client) | | **MEM Configuration Manager** | Customers who use Configuration Manager can deploy a policy with Configuration Manager's built-in WDAC integration, and then use the generated policy XML as an example base policy. | %OSDrive%\Windows\CCM\DeviceGuard on a managed endpoint | -| **SmartAppControl.xml** | This example policy includes rules based on [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see [Create a custom base policy using an example WDAC base policy](create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy)). | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies | +| **SmartAppControl.xml** | This example policy includes rules based on [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see [Create a custom base policy using an example WDAC base policy](create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy)). | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml
%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\SignedReputable.xml | +| **Example supplemental policy** | This example policy shows how to use supplemental policy to expand the DefaultWindows_Audit.xml allow a single Microsoft-signed file. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Supplemental.xml | +| **Microsoft Recommended Block List** | This policy includes a list of Windows and Microsoft-signed code that Microsoft recommends blocking when using WDAC, if possible. | [Microsoft recommended block rules](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules)
%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\Recommended_UserMode_Blocklist.xml | +| **Microsoft recommended driver blocklist** | This policy includes rules to block known vulnerable or malicious kernel drivers. | [Microsoft recommended driver block rules](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules)
%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\RecommendedDriverBlock_Enforced.xml
%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\Recommended_Driver_Blocklist.xml | +| **Windows S mode** | This policy includes the rules used to enforce [Windows S mode](https://support.microsoft.com/en-us/windows/windows-10-and-windows-11-in-s-mode-faq-851057d6-1ee9-b9e5-c30b-93baebeebc85). | %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\WinSiPolicy.xml.xml | +| **Windows 11 SE** | This policy includes the rules used to enforce [Windows 11 SE](/education/windows/windows-11-se-overview), a version of Windows built for use in schools. | %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\WinSEPolicy.xml.xml | + +> [!NOTE] +> Not all policies shown available at %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies can be found on all versions of Windows. diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md index f7a1d7f0a0..d6bf9271e0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md +++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md @@ -9,7 +9,7 @@ author: jgeurten ms.reviewer: aaroncz ms.author: jogeurte manager: aaroncz -ms.date: 06/27/2022 +ms.date: 11/02/2022 ms.custom: asr ms.topic: overview --- @@ -27,17 +27,17 @@ ms.topic: overview | Capability | Windows Defender Application Control | AppLocker | |-------------|------|-------------| -| Platform support | Available on Windows 10, Windows 11, and Windows Server 2016 or later | Available on Windows 8 or later | -| SKU availability | Cmdlets are available on all SKUs on 1909+ builds.
For pre-1909 builds, cmdlets are only available on Enterprise but policies are effective on all SKUs. | Policies deployed through GP are only effective on Enterprise devices.
Policies deployed through MDM are effective on all SKUs. | -| Management solutions |
  • [Intune](./deployment/deploy-windows-defender-application-control-policies-using-intune.md) (limited built-in policies or custom policy deployment via OMA-URI)
  • [Microsoft Configuration Manager](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) (limited built-in policies or custom policy deployment via software distribution)
  • [Group policy](./deployment/deploy-windows-defender-application-control-policies-using-group-policy.md)
  • PowerShell
|