{"id":410,"date":"2021-04-09T09:15:53","date_gmt":"2021-04-09T09:15:53","guid":{"rendered":"https:\/\/jadijkstra.nl\/?p=410"},"modified":"2021-04-09T09:15:56","modified_gmt":"2021-04-09T09:15:56","slug":"microsoft-wdac","status":"publish","type":"post","link":"https:\/\/jadijkstra.nl\/index.php\/2021\/04\/09\/microsoft-wdac\/","title":{"rendered":"Microsoft WDAC"},"content":{"rendered":"\n

In this Post I will go through implementing Microsoft WDAC
WDAC is Windows Defender Application Control.<\/p>\n\n\n\n

It is more effective then Microsoft AppLocker.
I am implementing this for a customer environment.<\/p>\n\n\n\n

Let’s go and WDAC!<\/p>\n\n\n\n

First, you need to have a reference machine which you use to create the base policy. Important to know is that all the applications you want to allow, needs to be installed prior to start the Policy Creation proces.<\/p>\n\n\n\n

Luckily there is a GUI for creating a policy which can be downloaded here : Microsoft WDAC Wizard<\/a><\/p>\n\n\n\n

This file you can download is an MSIX, which you (obviously) need to install with PowerShell. Really easy:<\/p>\n\n\n\n

Go to the reference machine where you download the Microsoft WDAC Wizards MSIX and put it in a directory where you want and open a PowerShell:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Run the following command to install the WDAC Wizard:<\/p>\n\n\n\n

Add-AppPackage -path “C:\\temp\\WDACWizard_1.6.3.0_x64_8wekyb3d8bbwe.MSIX”<\/em><\/p>\n\n\n\n

Ofcourse, make sure everything after -path should match your environment and MSIX file!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When installed, it is there in the start menu<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When starting the WDAC Wizard:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You can immediatly start creating a new policy or edit an existing policy or merge two existing policies into one.
I am going to create a new policy from my reference machine<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I am going to create a Multiple Policy Format and select Base policy as this is my first policy to create:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, we can choose Default Windows Mode, Allow Microsoft Mode and Signed and Reputable Mode.
Default is only allowing the applications stated and not more, the second allows all Microsoft Applications and the third allow applications to allow automatically if they have a good reputation using ISG (Intelligent Security Graph<\/a>)<\/p>\n\n\n\n

I will choose the Allow MIcrosoft Mode as the applications won’t be delivered through a portal or some kind. The applications being used in the company are static.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In the next screen, we are able to select the policy rules which should be set:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I have changed the settings to the following for customer specific needs:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I will leave the Policy in Audit Mode here, to see what the policy does<\/p>\n\n\n\n

There are additional Advanced Options available:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

But don’t using them right now.<\/p>\n\n\n\n

In the next screen, you are able to create allow or deny rules for applications, based on publisher, path or hash value.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We can create additional rules for applications here, I am going to create a rule for Google Chrome:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You can even create Custom Rule Exceptions for this rule!:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When added, it should be in the list<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Do this for every application!<\/p>\n\n\n\n

When ready, click Next<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


The policy is being created!<\/p>\n","protected":false},"excerpt":{"rendered":"

In this Post I will go through implementing Microsoft WDACWDAC is Windows Defender Application Control. It is more effective then Microsoft AppLocker.I am implementing this for a customer environment. Let’s go and WDAC! First, you need to have a reference machine which you use to create the base policy. Important to know is that all […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/posts\/410"}],"collection":[{"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/comments?post=410"}],"version-history":[{"count":4,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/posts\/410\/revisions"}],"predecessor-version":[{"id":429,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/posts\/410\/revisions\/429"}],"wp:attachment":[{"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/media?parent=410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/categories?post=410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jadijkstra.nl\/index.php\/wp-json\/wp\/v2\/tags?post=410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}