1

Has anyone successfully applied an App Control Policy (WDAC) on a non managed stand alone machine (not domain joined, not Intune registered)?

I have a couple stand along machines I would like to apply policy too. But I haven’t figured out a way to do it. I have seen some suggestion that its possible, but that I have to convert the XML into a CIP file and then code sign the CIP file before naming it SIPolicy.p7b and placing it into Windows\System32\CodeIntegrity. but I don’t have a way to code sign the file for testing.

8 Spice ups
2

Hi Molan,

Have you tried below article.

3 Spice ups
3

That is nearly identical to what I tried, but it is slightly different in that is uses the CIP file instead of the XML file.

I will try it and report back.

2 Spice ups
4

Have you seen this: Deploying WDAC on Stand‑Alone Windows PCs: methodology, internals, and a real‑world access‑control case
It might help you.

3 Spice ups
5

Thanks that is essentially what I tried the first time around.

The step that seems to be messing up that I can’t get by is the signing step. The policy has to be signed before windows will trust it and run it, otherwise its useless.

with Intune this is done transparently. On a stand alone machine it doesn’t happen transparently and I am having trouble getting that portion to work using a self signed cert.

2 Spice ups
6

You are looking for SignTool.exe, it is part of the windows SDK

What I do not know is what you are signing it against, usually the AD provides the policy key…

2 Spice ups