-
Notifications
You must be signed in to change notification settings - Fork 133
WDAC for Fully Managed Devices
Base policy type | Method used | Signed | Protection score 1-5 |
---|---|---|---|
Allow Microsoft / Default Windows | WDACConfig module | No | 4 |
-
This variant helps you create and deploy a WDAC policy for fully managed device using only Event Viewer audit logs.
-
This scenario includes using explicit Allow rules for files and certificates/singers, anything not allowed by the policies we are going to make are automatically denied/blocked.
Install Hyper-V role from optional Windows features if you haven't already.
Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All -norestart
Download the latest Windows .ISO
file from Microsoft website, create a new VM with it, install Windows and log in. Fully update Windows and then restart to apply the updates. You can create a Hyper-V checkpoint at this point so that you can return back to this clean state later on if you need to.
There are 2 types of base policies you can choose from.
- Allow Microsoft: Allows only files and apps that are signed by Microsoft's trusted root certificate.
- Default Windows: Allows only files and apps that come pre-installed by Windows.
New-WDACConfig -PrepMSFTOnlyAudit -LogSize 10MB
New-WDACConfig -PrepDefaultWindowsAudit -LogSize 10MB
Depending on whichever of the option you choose, it deploys the base policy in audit mode. No reboot required.
Install all of the programs that you want to allow in the WDAC policy, on the VM. These are the programs that you want to allow to run and be installed on the target system once you've deployed the WDAC policy.
-
Installing or running 3rd party non-Microsoft programs, while Allow Microsoft policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files.
-
Installing or running any program that doesn't come pre-installed by default with Windows, while Default Windows policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files.
These event logs are exactly what we need to identify and create Allow rules for the detected files.
Only files that are executed during Prep mode phase generate event logs, so by simply installing a program using its installer, we can't trigger event log generation for each of the components and executables that each program has. So, after installing the programs, run them, use them a bit as you normally would so that all of the programs' components are executed and event logs generated for them.
New-WDACConfig -MakePolicyFromAuditLogs -BasePolicyType 'Allow Microsoft Base' -NoDeletedFiles
New-WDACConfig -MakePolicyFromAuditLogs -BasePolicyType 'Default Windows Base' -NoDeletedFiles
All of the outputs are saved in a folder named "WDAC" inside the current working directory.
If you use the -Deployit
optional switch parameter with the commands above, 3 things will automatically happen:
- The deployed Prep mode base policy will be removed.
- The actual base policy will be deployed depending on whichever you choose.
- The Supplemental policy generated from Audit logs will be deployed.
If you don't use the -Deployit
switch, you can deploy the .cip
binary files manually using CITool.
Information about how to Sign and Deploy a Signed WDAC policy.
flowchart TD
A(Deploy Allow Microsoft base policy) -->B(Start running your programs)
B --> C[An App is getting blocked?]
C --> D[Is it a normal app?]
D --> E[Create Supplemental policy based on App's directory]
E --> F[New-SupplementalWDACConfig -Normal]
E --> G[Edit-WDACConfig -AllowNewApps]
C --> H[Is it a game Installed using Xbox app?]
H --> I[Is it an app that installs drivers outside app's directory?]
I --> J[Use Event viewer logs + game/app's directory scan]
J --> K[Edit-WDACConfig -AllowNewAppsAuditEvents]
C --> L[Want to allow an entire folder?]
L --> M[Use folder path with one or more Wildcards]
M --> N[New-SupplementalWDACConfig -FilePathWildCards]
flowchart TD
A(Deploy Default Windows base policy) -->B(Identify Important apps that need Supplemental policy)
B --> C(Create and Deploy Supplemental polcies for them)
C --> D[Another App is getting blocked?]
D --> E[Is it a normal app?]
E --> F[Create Supplemental policy based on App's directory]
D --> G[Is it a game Installed using Xbox app?]
G --> H[Is it an app that installs drivers outside app's directory?]
H --> I[Use Event viewer logs + game/app's directory scan]
I --> J[Edit-WDACConfig -AllowNewAppsAuditEvents]
D --> L[Want to allow an entire folder?]
L --> M[Use folder path with one or more Wildcards]
M --> N[New-SupplementalWDACConfig -FilePathWildCards]
F --> O[Edit-WDACConfig -AllowNewApps]
F --> Q[New-SupplementalWDACConfig -Normal]
- New-WDACConfig
- New-SupplementalWDACConfig
- Remove-WDACConfig
- Edit-WDACConfig
- Edit-SignedWDACConfig
- Deploy-SignedWDACConfig
- Confirm-WDACConfig
- New-DenyWDACConfig
- Set-CommonWDACConfig
- New-KernelModeWDACConfig
- Get-CommonWDACConfig
- Invoke-WDACSimulation
- Remove-CommonWDACConfig
- Assert-WDACConfigIntegrity
- Build-WDACCertificate
- Test-CiPolicy
- Get-CiFileHashes
- ConvertTo-WDACPolicy
- Get-CIPolicySetting
- Introduction
- App Control for Lightly Managed Devices
- App Control for Fully managed device - Variant 1
- App Control for Fully managed device - Variant 2
- App Control for Fully managed device - Variant 3
- App Control for Fully managed device - Variant 4
- App Control Notes
- How to Create and Deploy a Signed App Control Policy
- Fast and Automatic Microsoft Recommended Driver Block Rules updates
- App Control policy for BYOVD Kernel mode only protection
- EKUs in App Control for Business Policies
- App Control Rule Levels Comparison and Guide
- Script Enforcement and PowerShell Constrained Language Mode in App Control Policies
- How to Use Microsoft Defender for Endpoint Advanced Hunting With App Control
- App Control Frequently Asked Questions (FAQs)
- Create Bootable USB flash drive with no 3rd party tools
- Event Viewer
- Group Policy
- How to compact your OS and free up extra space
- Hyper V
- Overrides for Microsoft Security Baseline
- Git GitHub Desktop and Mandatory ASLR
- Signed and Verified commits with GitHub desktop
- About TLS, DNS, Encryption and OPSEC concepts
- Things to do when clean installing Windows
- Comparison of security benchmarks
- BitLocker, TPM and Pluton | What Are They and How Do They Work
- How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell
- Cloning Personal and Enterprise Repositories Using GitHub Desktop
- Only a Small Portion of The Windows OS Security Apparatus
- Clean Source principle, Azure and Privileged Access Workstations
- How to Securely Connect to Azure VMs and Use RDP
- Basic PowerShell tricks and notes
- Basic PowerShell tricks and notes Part 2
- Basic PowerShell tricks and notes Part 3
- Basic PowerShell tricks and notes Part 4
- Basic PowerShell tricks and notes Part 5
- How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time
- PowerShell Best Practices To Follow When Coding
- How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell
- Powershell Dynamic Parameters and How to Add Them to the Get‐Help Syntax
- RunSpaces In PowerShell
- How To Use Reflection And Prevent Using Internal & Private C# Methods in PowerShell