WDAC for Fully Managed Devices

Target Scenario: Fully managed devices

This page helps you create and deploy a WDAC policy for fully managed devices using Event Viewer audit logs. There are more ways to do this. Devices can either be centrally managed via MDM, Intune etc. or they can be home devices, devices that are private and don't belong to any organization, or the computer of someone that you want to keep 100% safe and secure so that even the device's owner can't willingly or forcefully compromise themselves, the possibilities are endless.
This scenario includes using explicit Allow rules for files and certificates/singers, anything not allowed by the policies we are going to make are automatically denied/blocked.
This scenario uses -Prep_MSFTOnlyAudit and -Make_PolicyFromAuditLogs parameters.

Prepare a Virtual Machine

Install Hyper-V role from optional Windows features if you haven't already.

 if((get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM).state -eq 'disabled'){enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All -norestart}

Download the latest Windows .ISO file from Microsoft website, create a new VM with it, install Windows and log in. Fully update Windows and then restart to apply the updates. You can create a Hyper-V checkpoint at this point so that you can return back to this clean state later on if you need to.

Prepare a Base policy

Using the WDACConfig module

New-WDACConfig -Prep_MSFTOnlyAudit

It deploys the the default AllowMicrosoft policy in audit mode. After running the command, restart your system.

Parameter Info

Generate Audit event logs on the system

Install all of the programs that you want to allow in the WDAC policy, on the VM. These are the programs that you want to allow to run and be installed on the target system once you've deployed the WDAC policy.

Installing 3rd party non-Microsoft programs, while AllowMicrosoft policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files. These event logs are exactly what we need to identify and create Allow rules for the detected files.

Only files that are executed and run generate event logs, so by simply installing a program using its installer, we can't trigger event log generation for each of the components and executables that each program has. So, after installing the programs, run each of them, use them a bit as you normally would so that all of the programs' components are executed and event logs generated for them.

Generate supplemental policy from the Audit event logs

Use WDACConfig Module with the following parameter:

New-WDACConfig -Make_PolicyFromAuditLogs

There are more optional parameter you can use.

It will automate the following tasks for you:

Creates a working directory called "WDAC" in the current User's folder and uses the Make_AllowMSFT_WithBlockRules parameter to create AllowMicrosoft with recommended block rules base policy.
Uses audit events to create WDAC policy file with the Level SignedVersion and Fallbacks FilePublisher, Hash, for files that currently exist on the disk.
Creates Hash rules for files that Event viewer logged but are no longer available on the disk, thus can't be detected by the previous step. Stores them in a new policy file.
Merges the policy file generated from Audit event logs (Files that currently exist on the disk) with the one that contains hash rules (Files that are no longer on the disk), and creates the final Supplemental policy file.
Converts the final Supplemental policy and base policy to .cip binary files, ready to be deployed.

After deploying the base and supplemental policies on a system, only these programs will be allowed to run and anything else will be blocked:

Programs signed by the Microsoft product root certificate.
Programs you installed on the VM during the audit mode.

Deploy the WDAC policy

You must Sign the WDAC policy if you want to deploy it on a system where user has Administrator privileges because an Administrator can easily disable and/or delete the WDAC policy that you deployed.

Even if you are deploying it on systems where users only have Standard privileges (non-admin), it's still highly recommended to cryptographically Sign the WDAC policy to eliminate any possibility of tampering.

Refer to this Wiki page for all the information about how to Sign and Deploy a Signed WDAC policy.

Once you have your .cip policy binary files, you can deploy all of them (Base policy and supplemental policies) at once.