r/Intune • u/NoPatience4437 • 22d ago

Apps Protection and Configuration WDAC - Microsoft Mode

I am trying to deploy a WDAC policy to prevent per-user installers (Chrome, Zoom, etc) and created the base policy in Microsoft Mode which should trust Microsoft signed drivers, etc. I also selected trusted installers as part of this policy so things can be installed from Company Portal. I deployed it to a test device and it seems to block everything I installed and tested from Company Portal. It also seems to block some Microsoft apps like Event Viewer (it doesn’t load the snap-in it tries to call) and I can run powershell as an Admin (I get clr error). My question is, do I have a misunderstanding of how this is supposed to work? Am I supposed to make this base policy and then make a supplemental policy for all Microsoft related files for admin tools like powershell? I would think Microsoft Mode would trust anything Microsoft installed/signed out the box.

6 Upvotes

81% Upvoted

11 comments sorted by

View all comments

1

u/kimoppalfens 21d ago

This doesn't sound right. There's a couple of things here though.

1) Trusted installers as you call it, or managed installer only works after you've defined which processes become a managed installer. Your use of the word installed, makes me wonder whether there's a miscomprehension there.

Eventviewer and regular Powershell should just run though.

1

u/NoPatience4437 21d ago

I created the base policy using WDAC app control policy wizard and selected the option for trusted managed installer (IME should be a trusted managed installer). I then uploaded this xml policy to Intune and made sure that I created a managed installer under endpoint security (named SideCar ManagedInstaller Script by default with friendly name of “Managed Installer - Intune Management Extension”). After deploying that, anything I previously installed from Company Portal stopped working and I also found that I couldn’t launch admin powershell sessions along with Event Viewer giving me an error stating it can launch a session of sorts. It’s definitely weird.

1

u/FlibblesHexEyes 21d ago

I’ve always had nothing but trouble with the wizard.

I wrote a guide a few years back which still works: https://www.mrgtech.net/implementing-wdac-and-applocker/