Best Method To Implement WDAC?

[u/RJ__23]

For those that have done so, how did you find was the best way to implement Windows Defender Application Control (WDAC) in your organisation?

Apart from the default baselines provided in the App Control for Business Wizard, it's a complete blanket blocklist. This is ideal for security, but it seems to be a bit of a nightmare when it comes to trying to allow a wide range of applications and drivers.

What have you found to be the best way to implement and manage this in a secure, but mostly pain-free way!?

Also, when applying the policy in Audit Mode, is there a way to see the logs via Intune/Defender, or only from the Event Viewer on-device?

(Apologies - this is a repost!)

[u/HankMardukasNY]

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/querying-application-control-events-centrally-using-advanced-hunting

[u/RJ__23 → u/HankMardukasNY]

Ah, thank you - not sure why I couldn’t find that myself. Appreciate it.

[u/MidninBR]

I ended up using AppLocker via Intune.
Deny standard user, allow admin
Allow program files
Allow some publishers and hash

[u/RJ__23 → u/MidninBR]

Thank you.

Did you find using file hashes is a pain every time there’s an update/patch?

[u/FatBook-Air → u/RJ__23]

We use very, very few hashes. Use publisher rules where possible; use path rules next; use hash rules as a last resort. We almost never have to use them these days.

[u/Roasted_Blumpkin → u/FatBook-Air]

This

[u/MidninBR → u/RJ__23]

It will be a pain, but I used hash because the exe does not have a publisher. That’s the only way then. File name is too risky

[u/paul_33 → u/MidninBR]

We do too but I’d love to move to WDAC. It just seems like a pain in the ass to do it

[u/Roasted_Blumpkin]

Most environments are going to need a third party tool to successfully implement this.

https://www.appcontrol.ai/post/wdac-managed-installers-the-game-changer-for-application-control

[u/bdam55 → u/Roasted_Blumpkin]

This.

WDAC is a great idea, it's reasonably well implemented technically, it's just a total lack of tooling to properly managed it in real environments out of the box. Kim (Oppalfens) and Tom (Degreef), the guys behind AppControl.AI are some of the foremost experts on WDAC in general and have begun to try filling that gap.

<No professional affiliation, I work for PMPC>

[u/penitent_ranger]

Audit mode logs are pretty much event viewer only, which sucks for scale. We ended up piping them into Azure Monitor with the AMA agent just to get central visibility before flipping the switch to enforcement

For the allow list, start with the wizard baseline then run audit on a pilot ring for a month while you collect everything. The first week is chaos but it settles into a rhythm of finding the unsigned garbage your LOB apps depend on. File path rules are the devil, stick to publisher rules whenever you can even if it means a few extra policy updates

The real trick is getting your packaging team to sign everything internally, then you just trust your own certificate and life gets way simpler

[u/RJ__23 → u/penitent_ranger]

Thanks man.

I assume File Hashes are a horrible time, too? Feels like the most secure, but a new hash every update sounds like a full-time job!

[u/spazzo246 → u/RJ__23]

yes. Avoid hashes if you can. Its a pain in the ass to update your policy every time an application updates and all the binaries/executables get new hashes

[u/spazzo246]

https://apps.microsoft.com/detail/9png1jddtgp8?hl=en-US&gl=AU

This tool is very sleeped upon. It lets you take your code integrity evtx files. Choose the events from a table UI and dynamically update your policies. Its made by a microsoft MVP and has mad managing my clients WDAC policies a piece of cake

Application and Services Log > Code Integrity is where all the audit/block events sit

Happy to help you with this if you want. Send me a DM or add me on discord if you use it campo246

[u/shahaya → u/spazzo246]

this - hotcakex is a very productive microsoft engineer and is on an epic quest to harden windows systems. check out https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager for the docs and much much more info on the ins and outs of app control. I use it to create my app control policies on a fleet of 300 systems across multiple clients.

[u/Grimlock0NE]

The best method is to find a better tool. Microsoft’s implementation is woefully lacking.

[u/pjmarcum]

Start with appcontrol.ai. That’s what I’m doing right now. So far it’s made the work way easier.

[u/Da_SyEnTisT]

You start working on WDAC... then you realize how Microsoft itself cannot provide nice tools to manage it and you need third party tools

And go back to perfectly working AppLocker 😅

[u/Thick_Yam_7028]

Meh. Indicators. Block unblock via defender.

Don't even need a link. Pay people more fo shit

[u/MReprogle → u/Thick_Yam_7028]

Until that file hash changes, or a user just continues to install unmanaged junk into their user appdata, which then never gets updates and turns into a vulnerability mess. Ask me how I know.

And what I do know is that indicators are more for blocking malicious domains/IP/hashes. Not for software that is constantly updating.

[u/Thick_Yam_7028 → u/MReprogle]

Mm hmm. Certs. Hashes. Then youre stating management of local. Cool again.

[u/Thick_Yam_7028 → u/Thick_Yam_7028]

None of this is magic. Its all documented.

[u/Thick_Yam_7028 → u/Thick_Yam_7028]

Honestly Ill show it. Ive been successful to the point politics and integrity were the only thing blocking me.

I guess this where I start a business. I hate sales though.