Windows 10: Signing an audit App Control for Business WDAC Policy Doesn't Log Events?

Hello,We have several App Control for Business policies deployed on our fleet of machines, several of them are signed and enforced.We had one policy in audit mode unsigned, and the Code Integrity logs for this policy came in just fine. No issues for months.We decided to sign it and leave it in audit mode -- however, signing the audit policy caused events to not be logged anymore.We've verified that the policy is "signed","authorized", and "enforced" using the CiTool.Can someone confirm that signed, audit, app control policies should be logging things?Thanks!

:)

 

Unable to sign WDAC policy file(bin or p7b) file.

Hi,

To sign our WDAC policy file we are following Microsoft article Use signed policies to protect Windows Defender Application Control. In order to sign SIPolicy file we need to have code signing certificate. We need few clarifications which are described below:

1) As per above mentioned link, it specifically needs ContosoSigningCert code signing certificate to sign the WDAC policy, below is the mentioned command. As we are unable to get this certificate, can you please provide us this certificate. Or in case we can sign it with some other certificate, please share information regarding that.

<Path to signtool.exe> sign -v -n "ContosoSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin

2) We also checked about Device Guard Signing Service v2 (DGSS) is a code signing service. But information available over the web is too generic to apply for our case. In order to sign our WDAC policy file can we get some concrete steps wise information or any other related information regarding this.

Regards,

Vikram

 

Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph

Hi,



Thank you for writing to Microsoft Community Forums.



In order to enable trust for executables based on classifications in the ISG, the
Enabled:Intelligent Security Graph authorization option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition, it is recommended from a security perspective to also enable the
Enabled:Invalidate EAs on Reboot option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG.



Since the ISG relies on identifying executables as being known good, there are cases where it may classify legitimate executables as unknown, leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate
trusted in the WDAC policy or by deployment through a WDAC managed installer. Typically, this is due to an installer or application using a dynamic file as part of execution. These files do not tend to
build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG.



Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business. It is straightforward to authorize modern apps with
signer rules in the WDAC policy.



Enabled:Intelligent Security Graph Authorization -> Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG).



Enabled:Invalidate EAs on Reboot -> When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically
re-validate the reputation for files that were authorized by the ISG.



For more information, you may refer the below articles.

• Use
  Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph.
  
• Deploy Windows
  Defender Application Control policy rules and file rules.
  
• Use
  signed policies to protect Windows Defender Application Control against tampering.
  

If you still have questions, then I suggest you to post your query in
IT Pro TechNet Forums, where we have support
professionals who are well equipped with the knowledge on Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph.



Please feel free to contact us back, in case you have any other questions/issues with Windows in future.

 

Disable script enforcement for all policies (WDAC)

Hello

We would like to prohibit the use of the app “Mail – microsoft.windowscommunicationsapps” via a WDAC policy distributed by Intune.

We also use the "psappdeploytoolkit", but the execution of the device is not possible because of the "Constrained Language Mode"

Problem Described here: AppDeployToolkitMain.cs could not be opened

We used this script to generate the WDAC Policy:

We added based on the AllowAll.xml Policy some deny rules for the "windowscommunicationsapps" App and removed the Script Enforcement.

The "windowscommunicationsapps" App is getting blocked, but we are now in the "ConstrainedLanguage"Powershell Mode.

The Documentation of the "Script Enforcement" there is writte:

WDAC puts interactive PowerShell into Constrained Language Mode if any WDAC UMCI policy is enforced and any active WDAC policy enables script enforcement,, even if that policy is in audit mode. To run interactive PowerShell with Full Language rights, you must disable script enforcement for all policies. Understand App Control script enforcement

My Question is, How to disable script enforcement for all policies?