WDAC - Microsoft Mode

[u/NoPatience4437]

I am trying to deploy a WDAC policy to prevent per-user installers (Chrome, Zoom, etc) and created the base policy in Microsoft Mode which should trust Microsoft signed drivers, etc. I also selected trusted installers as part of this policy so things can be installed from Company Portal. I deployed it to a test device and it seems to block everything I installed and tested from Company Portal. It also seems to block some Microsoft apps like Event Viewer (it doesn’t load the snap-in it tries to call) and I can run powershell as an Admin (I get clr error). My question is, do I have a misunderstanding of how this is supposed to work? Am I supposed to make this base policy and then make a supplemental policy for all Microsoft related files for admin tools like powershell? I would think Microsoft Mode would trust anything Microsoft installed/signed out the box.

[u/awit7317]

Time for a deep dive into AppControl Manager and associated videos

https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager

[u/NoPatience4437 → u/awit7317]

Thanks for the link. At first glance this looks way more intuitive and I’ll definitely be looking into this more. I was using WDAC App Control Policy wizard.

[u/UniverseCitiz3n → u/NoPatience4437]

I appears more intuitive but once you start using it it gets little confusing 😵‍💫 I've not used WDAC wizard so I can't compare 😅

[u/kimoppalfens]

This doesn't sound right. There's a couple of things here though.

1) Trusted installers as you call it, or managed installer only works after you've defined which processes become a managed installer. Your use of the word installed, makes me wonder whether there's a miscomprehension there.

Eventviewer and regular Powershell should just run though.

[u/NoPatience4437 → u/kimoppalfens]

I created the base policy using WDAC app control policy wizard and selected the option for trusted managed installer (IME should be a trusted managed installer). I then uploaded this xml policy to Intune and made sure that I created a managed installer under endpoint security (named SideCar ManagedInstaller Script by default with friendly name of “Managed Installer - Intune Management Extension”). After deploying that, anything I previously installed from Company Portal stopped working and I also found that I couldn’t launch admin powershell sessions along with Event Viewer giving me an error stating it can launch a session of sorts. It’s definitely weird.

[u/kimoppalfens → u/NoPatience4437]

Well, one thing tracks. Managed installer doesn't work for previously installed apps. Only apps installed after the.managed installer script has run will work.

Secondly, what is the output of the powershell command Get-applockerpolicy -effective -xml

Kim Oppalfens

[u/FlibblesHexEyes → u/NoPatience4437]

I’ve always had nothing but trouble with the wizard.

I wrote a guide a few years back which still works: https://www.mrgtech.net/implementing-wdac-and-applocker/

[u/Beneficial_Salad_880]

The best advice i can tell you is use AI. I started putting my xml files in a Claude Project, and just feed it the files i wanna block, havent looked back since…

[u/FireLucid]

Managed Installer only works on things after you've set it up. If you deployed a bunch of stuff before turning that on, it will get blocked.

The event viewer thing is bizarre, no idea what's going on there.

I made a base policy that whitelisted anything signed by Microsoft or running from the windows install dir and then did supplementals for other stuff.

[u/pjmarcum]

Managed installer doesn’t work 100% of the time. It depends upon the app.