From fcb764edb4e2c17b644e6e9a4caa35acd3fd007d Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Fri, 4 Nov 2022 15:34:25 -0700 Subject: [PATCH] Various doc fixes --- ...e-wdac-policy-for-fully-managed-devices.md | 10 ++-- ...wdac-policy-for-lightly-managed-devices.md | 12 ++-- .../microsoft-recommended-block-rules.md | 60 +++++++------------ 3 files changed, 33 insertions(+), 49 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index cea19f889b..b6760608a8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -12,10 +12,10 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 11/20/2019 +ms.date: 11/04/2022 ms.technology: itpro-security --- @@ -60,7 +60,7 @@ Based on the above, Alice defines the pseudo-rules for the policy: - WHQL (third-party kernel drivers) - Windows Store signed apps -2. **"MEMCM works”** rules that include signer and hash rules for Configuration Manager components to properly function. +2. **"ConfigMgr works”** rules that include signer and hash rules for Configuration Manager components to properly function. 3. **Allow Managed Installer** (Configuration Manager and *LamnaITInstaller.exe* configured as a managed installer) The critical differences between this set of pseudo-rules and those pseudo-rules defined for Lamna's [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: @@ -85,13 +85,13 @@ Alice follows these steps to complete this task: $PolicyPath=$env:userprofile+"\Desktop\" $PolicyName= "Lamna_FullyManagedClients_Audit" $LamnaPolicy=$PolicyPath+$PolicyName+".xml" - $MEMCMPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml" + $ConfigMgrPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml" ``` 3. Copy the policy created by Configuration Manager to the desktop: ```powershell - cp $MEMCMPolicy $LamnaPolicy + cp $ConfigMgrPolicy $LamnaPolicy ``` 4. Give the new policy a unique ID, descriptive name, and initial version number: diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md index e8c10ae63e..1f53521b1c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md @@ -12,10 +12,10 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 08/10/2022 +ms.date: 11/04/2022 ms.technology: itpro-security --- @@ -35,7 +35,7 @@ This section outlines the process to create a Windows Defender Application Contr > [!NOTE] > Some of the Windows Defender Application Control options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. -As in the [previous article](types-of-devices.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. +As in [Windows Defender Application Control deployment in different scenarios: types of devices](types-of-devices.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. **Alice Pena** is the IT team lead tasked with the rollout of WDAC. Lamna currently has loose application usage policies and a culture of maximum app flexibility for users. So, Alice knows she'll need to take an incremental approach to application control and use different policies for different workloads. @@ -58,7 +58,7 @@ Based on the above, Alice defines the pseudo-rules for the policy: - WHQL (third-party kernel drivers) - Windows Store signed apps -1. **"MEMCM works”** rules that include: +1. **"ConfigMgr works”** rules that include: - Signer and hash rules for Configuration Manager components to properly function. - **Allow Managed Installer** rule to authorize Configuration Manager as a managed installer. @@ -122,8 +122,8 @@ Alice follows these steps to complete this task: > If you do not use Configuration Manager, skip this step. ```powershell - $MEMCMPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml" - Merge-CIPolicy -OutputFilePath $LamnaPolicy -PolicyPaths $LamnaPolicy,$MEMCMPolicy + $ConfigMgrPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml" + Merge-CIPolicy -OutputFilePath $LamnaPolicy -PolicyPaths $LamnaPolicy,$ConfigMgrPolicy Set-RuleOption -FilePath $LamnaPolicy -Option 13 # Managed Installer ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 717cc67a0a..ff4a4db2c5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -9,7 +9,7 @@ author: jsuther1974 ms.reviewer: jgeurten ms.author: vinpa manager: aaroncz -ms.date: 09/29/2021 +ms.date: 11/04/2022 ms.topic: reference --- @@ -22,11 +22,11 @@ ms.topic: reference - Windows Server 2016 and above >[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). +>Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [WDAC feature availability](feature-availability.md). -Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control. +Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass WDAC. -Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including Windows Defender Application Control: +Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including WDAC: - addinprocess.exe - addinprocess32.exe @@ -100,19 +100,19 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you > [!NOTE] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. -Certain software applications may allow other code to run by design. Such applications should be blocked by your Windows Defender Application Control policy. In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add *deny* rules to your application control policies for that application’s previous, less secure versions. +Certain software applications may allow other code to run by design. Such applications should be blocked by your WDAC policy. In addition, when an application version is upgraded to fix a security vulnerability or potential WDAC bypass, you should add *deny* rules to your application control policies for that application’s previous, less secure versions. -Microsoft recommends that you install the latest security updates. For example, updates help resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control. These modules can't be blocked by name or version, and therefore must be blocked by their corresponding hashes. +Microsoft recommends that you install the latest security updates. For example, updates help resolve several issues in PowerShell modules that allowed an attacker to bypass WDAC. These modules can't be blocked by name or version, and therefore must be blocked by their corresponding hashes. As of October 2017, system.management.automation.dll is updated to revoke earlier versions by hash values, instead of version rules. -Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. As of March 2019, each version of Windows requires blocking a specific version of the following files: +If you wish to use this denylist policy on Windows Server 2016, locate the deny rules for the following files and change the comment block to only include the rules for that OS version. Applying the RS5+ rules to Windows Server 2016 may cause apps to malfunction: - msxml3.dll - msxml6.dll - jscript9.dll -Select the correct version of each .dll for the Windows release you plan to support, and remove the other versions. Ensure that you also uncomment them in the signing scenarios section. +The denylist policy below includes "Allow all" rules for both kernel and user mode which make it safe to deploy as a standalone WDAC policy. On Windows versions 1903 and above, Microsoft recommends converting this policy to multiple policy format using the *Set-CiPolicyIdInfo* cmdlet with the *-ResetPolicyId* switch. Then, you can deploy it as a Base policy side-by-side with any other policies in your environment. To instead add these rules to an existing Base policy, you can merge the policy below using the *Merge-CIPolicy* cmdlet. If merging into an existing policy that includes an explicit allowlist, you should first remove the two "Allow all" rules and their corresponding FileRuleRefs from the sample policy below.
@@ -145,6 +145,8 @@ Select the correct version of each .dll for the Windows release you plan to supp + + @@ -161,7 +163,7 @@ Select the correct version of each .dll for the Windows release you plan to supp - + @@ -182,7 +184,7 @@ Select the correct version of each .dll for the Windows release you plan to supp - + @@ -197,26 +199,11 @@ Select the correct version of each .dll for the Windows release you plan to supp --> - - - - - --> + @@ -854,6 +841,7 @@ Select the correct version of each .dll for the Windows release you plan to supp + @@ -861,6 +849,7 @@ Select the correct version of each .dll for the Windows release you plan to supp + @@ -877,7 +866,7 @@ Select the correct version of each .dll for the Windows release you plan to supp - + @@ -897,7 +886,7 @@ Select the correct version of each .dll for the Windows release you plan to supp - + @@ -905,11 +894,9 @@ Select the correct version of each .dll for the Windows release you plan to supp - + + + @@ -1528,9 +1515,6 @@ Select the correct version of each .dll for the Windows release you plan to supp
-> [!NOTE] -> To create a policy that works on both Windows 10, version 1803 and version 1809, you can create two different policies, or merge them into one broader policy. - ## More information -- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) +- [Merge WDAC policies](merge-windows-defender-application-control-policies.md)