WDAC for Fully Managed Devices

Target Scenario: Fully managed devices

• This page helps you create and deploy a WDAC policy for fully managed devices using Event Viewer audit logs. There are more ways to do this. Devices can either be centrally managed via MDM, Intune etc. or they can be home devices, devices that are private and don't belong to any organization, or the computer of someone that you want to keep 100% safe and secure so that even the device's owner can't willingly or forcefully compromise themselves, the possibilities are endless.

• Since this scenario includes using explicit Allow rules for files and certificates/singers, there is no need to use/include Microsoft recommended driver block rules or Microsoft recommended block rules, because anything not allowed by the policies we are going to make are automatically denied/blocked.

• We use New-ConfigWDAC Module to automate most of the tasks.

Prepare a Virtual Machine

Install Hyper-V role from optional Windows features if you haven't already.

 if((get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM).state -eq 'disabled'){enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All -norestart}

Download the latest Windows .ISO file from Microsoft website, create a new VM with it, install Windows and log in. Fully update Windows and then restart to apply the updates. You can create a Hyper-V checkpoint at this point so that you can return back to this clean state later on if you need to.

Prepare a Base policy

• Copy the AllowMicrosoft.xml example policy located in %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml, to another location like desktop.

• Set 3 Enabled:Audit Mode rule option and activate Audit mode for AllowMicrosoft.xml Policy.

• Reset the Policy ID.

• Convert the XML policy to .cip binary and put it in "C:\Windows\System32\CodeIntegrity\CiPolicies\Active"

• Restart the system to activate it.

Use the New-ConfigWDAC Module to automate all of the steps above

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/New-ConfigWDAC/New-ConfigWDAC.ps1" -OutFile "New-ConfigWDAC.ps1"
Import-Module .\New-ConfigWDAC.ps1 -Force
New-ConfigWDAC -Prep_System_For_MSFT_Only_Audit

Generate Audit event logs on the system

Install all of the programs that you want to allow in the WDAC policy, on the VM. These are the programs that you want to allow to run and be installed on the target system once you've deployed the WDAC policy.

Installing 3rd party non-Microsoft programs, while AllowMicrosoft policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files. These event logs are exactly what we need to identify and create Allow rules for the detected files.

Only files that are executed and run generate event logs, so by simply installing a program using its installer, we can't trigger event log generation for each of the components and executables that each program has. So, after installing the programs, run each of them, use them a bit as you normally would so that all of the programs' components are executed and event logs generated for them.

Generate supplemental policy from the Audit event logs

Use New-ConfigWDAC Module with the following parameter:

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/New-ConfigWDAC/New-ConfigWDAC.ps1" -OutFile "New-ConfigWDAC.ps1"
Import-Module .\New-ConfigWDAC.ps1 -Force
New-ConfigWDAC -MakePolicy_From_AuditLogs

It will automate the following tasks for you:

• Creates a working directory called "WDAC" in the current User's folder and copies AllowMicrosoft.xml file from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\ to "WDAC" folder, then resets its policy ID.

• Uses audit events to create WDAC policy file with the Level PcaCertificate and Fallbacks FilePublisher, Publisher, SignedVersion, FileName, Hash, for files that currently exist on the disk.

• Creates Hash rules for files that Event viewer logged but are no longer available on the disk, thus can't be detected by the previous step.

• Creates a policy XML file that has no rules, uses it as a template to store the Rules and Rule Refs created in the previous step.

• Converts the new policy file from Base policy mode to supplemental policy mode of the base policy, AllowMicrosoft.

• Merges the policy file generated from Audit event logs (Files that currently exist on the disk) with the one that contains hash rules (Files that are no longer on the disk), and creates the final Supplemental policy file.

• Sets rule options for both AllowMicrosoft and Supplemental policies.

• Sets HVCI to Strict.

• Converts the final Supplemental policy and base policy to .cip binary files, ready to be deployed.

Files in the WDAC folder

Important files

• AllowMicrosoft.xml: The default official policy copied from Windows folder, in Enforcement mode.
• SupplementalPolicy.xml: The supplemental policy created using the script.
• {GUID}.cip: Binary file for AllowMicrosoft Policy, ready for deployment.
• {GUID}.cip: Binary file for SupplementalPolicy policy, ready for deployment.

Informational files

• WDAC_From_AuditEvents.xml: The policy file generated from Audit Event logs based on the specified Level and Fallback parameters.
• FileRulesAndFileRefs.txt: Contains the File Rules and Rule refs for the Hash of the files that no longer exist on the disk.
• DeletedFilesHashes.XML: policy file that contains File Rules and Rule refs for the files that no longer exist on the disk.
• Warnings.txt: Warnings about files that are no longer available on the disk, auto-generated when you run New-CIPolicy cmdlet in audit mode to capture Event logs.

So, after deploying the AllowMicrosoft and SupplementalPolicy on a system, only these programs will be allowed to run and anything else will be blocked:

1. Programs signed by the Microsoft product root certificate.
2. Programs you installed on the VM during the audit mode.

Deploy the WDAC policy

You must Sign the WDAC policy if you want to deploy it on a system where user has Administrator privileges because an Administrator can easily disable and/or delete the WDAC policy that you deployed.

Even if you are deploying it on systems where users only have Standard privileges (non-admin), it's still highly recommended to cryptographically Sign the WDAC policy to eliminate any possibility of tampering.

Refer to this Wiki page for all the information about how to Sign and Deploy a Signed WDAC policy.

Once you have your .cip policy binary files, you can deploy all of them (Base policy and supplemental policies) at once.