1

I’m really struggling with implementing WDAC. I’ve deployed the audit mode policy via Intune and assigned it to all users
around 1,800 devices. Using Microsoft Security’s Advanced Hunting, I’ve collected logs across all these devices. The logs have been analyzed and grouped accordingly.

I used the App Control Wizard’s Policy Editor to manually convert the audit event logs into allow policies by approving relevant file paths. I did the same for Publisher rules as well. My goal is to merge these two policies and deploy them via Intune, so I can have one robust allow policy across all devices. Eventually, I plan to switch from audit mode to enforced (block) mode.

I’ve attempted to merge the two policies, but I’ve been unable to successfully convert the merged XML to a .bin file for deployment. Even deploying them separately isn’t working—and I’d prefer not to go down that path anyway. I understand App Control Manager might support this kind of workflow, but unfortunately, we can’t use it in our environment due to authentication issues.

Could anyone advise on best practices, tools, or PowerShell scripts that could help get this working? I’ve been stuck on this for two weeks and would really appreciate any support or suggestions.

5 Spice ups
2

in my testing there seems to be a limit to size of the xml file that gets created. is a tricky thing. If the file is bigger than said limit then it won’t work.

For the moment I am successfully using signed and reputable mode, but I also has major struggles getting the other modes to work as expected.

In Intune have you looked into enabling managed installer? it won’t help in the short term but long term App Control will auto trust anything you install via intune once managed Installer is enabled

2 Spice ups
3

I managed to clean the XML file this morning and created the .bin file, which I then deployed to Intune fingers crossed. Honestly, Microsoft needs to do more with this feature limited SME support and a lack of quality resources really hold it back.

3 Spice ups
4

I would agree. its a very powerful security protection, but they make it way to hard to manage.
They should take lessons from Threat Locker in this area.

are you using the downloadable “App Control Policy Wizard”

2 Spice ups
5

I’m on the user support side of the house, Corporate did the audit & enforce stuff. Most old applications, or crappily-coded applications, which install in their own directory off the root of C: and cannot have the installation redirect to C:\Program Files (x86) did not seem to show up in logs while in audit mode. So, they got blocked after enforce mode was enabled on those computers, and they require individual handling for whitelisting. Ended up returning many of those pc’s to audit mode while they scrutinize the CodeIntegrity event logs more closely.

2 Spice ups