Chapter 14 – Windows Defender Application Control (WDAC)

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 14 – Windows Defender Application Control (WDAC)

Learning Objectives

Understand WDAC architecture, code integrity policies, deployment methods, audit mode, enforcement mode, and enterprise application control.

1. What is WDAC?

Windows Defender Application Control (WDAC), also called App Control for Business, allows organizations to define trusted applications using code integrity policies. WDAC provides stronger protection than AppLocker because it operates at the kernel level and can restrict unsigned or untrusted code before execution.

2. GPO Path

Computer Configuration → Administrative Templates → System → Device Guard (legacy policy location for many WDAC settings). Modern WDAC policies are created as Code Integrity (CI) policies and deployed through management tools.

3. WDAC Components

Code Integrity Policy (CIP), Intelligent Security Graph (ISG), Managed Installer, Supplemental Policies, User Mode Code Integrity (UMCI), Kernel Mode Code Integrity (KMCI).

4. Deployment Modes

Audit Mode records events without blocking applications. Enforced Mode blocks applications that do not satisfy the policy. Always validate in Audit Mode before switching to enforcement.

5. Policy Creation

Create baseline policies using PowerShell, merge supplemental policies, sign policies when required, and deploy through Group Policy, Microsoft Intune, Configuration Manager, or scripts depending on the environment.

6. Managed Installer

A managed installer such as Microsoft Configuration Manager can mark applications it installs as trusted, reducing administrative effort.

7. Enterprise Best Practices

Start with Microsoft's recommended base policy, pilot on test devices, review audit events, maintain change documentation, and create supplemental policies for business applications.

8. PowerShell Commands

New-CIPolicy
Merge-CIPolicy
ConvertFrom-CIPolicy
Set-RuleOption
Get-CimInstance Win32_DeviceGuard

9. Event Logs

Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational. Review audit and enforcement events before production rollout.

10. Troubleshooting

Verify the Code Integrity policy is deployed, review CodeIntegrity operational logs, confirm Secure Boot and virtualization-based security requirements where applicable, test with audit mode first, and check effective policy version.

11. Comparison: WDAC vs AppLocker

WDAC offers stronger kernel-level enforcement and is recommended for high-security environments. AppLocker is simpler to manage for many organizations and focuses on user-mode application control.

12. Interview Questions

What is WDAC? How is WDAC different from AppLocker? What is a Code Integrity Policy? Why should Audit Mode be used before enforcement?

13. Practical Lab

Generate a baseline Code Integrity policy, deploy it in Audit Mode to a test computer, review CodeIntegrity logs, then enable Enforced Mode after validating application compatibility.

WDAC Quick Reference

Feature

Recommendation

Purpose

Audit Mode

Use first

Compatibility testing

Enforced Mode

After validation

Application control

Managed Installer

Enable if available

Trust enterprise-installed apps

Supplemental Policies

Use

Add approved applications

Code Integrity Logs

Review regularly

Troubleshooting

Secure Boot

Enable

Improve trust chain

VBS/HVCI

Enable where supported

Enhanced protection

Official Microsoft Learn

App Control for Business (WDAC)

WDAC Design Guide

Deploy WDAC Policies

ConfigCI PowerShell

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more