Skip to content

Commit 166792a

Browse files
HotCakeXsdwheelervinaypamnani-msft
authored
Corrected the names referring to WDAC to use App Control (#11481)
* WDAC is now App Control Changed the old names to the new ones. WDAC is called App Control or App Control for Business. * Update how-wdac-works.md Not sure if you want to change the link. * Apply suggestions from code review Co-authored-by: Vinay Pamnani <[email protected]> --------- Co-authored-by: Sean Wheeler <[email protected]> Co-authored-by: Vinay Pamnani <[email protected]>
1 parent c17230f commit 166792a

File tree

1 file changed

+15
-15
lines changed

1 file changed

+15
-15
lines changed

reference/docs-conceptual/security/app-control/how-wdac-works.md

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
11
---
2-
description: This article explains how WDAC works to secure PowerShell and the restrictions it imposes.
2+
description: This article explains how App Control for Business works to secure PowerShell and the restrictions it imposes.
33
ms.date: 09/19/2024
4-
title: How WDAC works with PowerShell
4+
title: How App Control for Business works with PowerShell
55
---
6-
# How WDAC works with PowerShell
6+
# How App Control works with PowerShell
77

8-
This article explains how **Windows Defender Application Control** (WDAC) secures PowerShell and the
8+
This article explains how **App Control for Business** secures PowerShell and the
99
restrictions it imposes. The secure behavior of PowerShell varies based on the version of Windows
1010
and PowerShell you're using.
1111

1212
## How PowerShell detects a system lockdown policy
1313

14-
PowerShell detects both **AppLocker** and **Windows Defender Application Control** (WDAC) system
15-
wide polices. AppLocker is deprecated. WDAC is the preferred application control system for Windows.
14+
PowerShell detects both **AppLocker** and **App Control for Business** system
15+
wide polices. AppLocker is deprecated. App Control is the preferred application control system for Windows.
1616

17-
### Legacy WDAC policy enforcement detection
17+
### Legacy App Control policy enforcement detection
1818

19-
PowerShell uses the legacy WDAC `WldpGetLockdownPolicy` API to discover two things:
19+
PowerShell uses the legacy App Control `WldpGetLockdownPolicy` API to discover two things:
2020

2121
- System wide policy enforcement: `None`, `Audit`, `Enforce`
2222
- Individual file policy: `None`, `Audit` (allowed by policy), `Enforce` (not allowed by policy)
2323

24-
All versions of PowerShell (v5.1 - v7.x) support this WDAC policy detection.
24+
All versions of PowerShell (v5.1 - v7.x) support this App Control policy detection.
2525

26-
### Latest WDAC policy enforcement detection
26+
### Latest App Control policy enforcement detection
2727

28-
WDAC introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
28+
App Control introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
2929
the new `WldpCanExecuteFile` API to decide how a file should be handled. Windows PowerShell 5.1
3030
doesn't support this new API. The new API takes precedence over the legacy API for individual files.
3131
However, PowerShell continues to use the legacy API to get the system wide policy configuration. If
@@ -54,7 +54,7 @@ this mode, see the [PowerShell restrictions under lockdown policy][02] section o
5454

5555
### Noninteractive mode running under policy enforcement
5656

57-
When PowerShell runs a script or loads a module, it uses the WDAC API to get the policy enforcement
57+
When PowerShell runs a script or loads a module, it uses the App Control API to get the policy enforcement
5858
for the file.
5959

6060
PowerShell version 7.3 or higher uses the `WldpCanExecuteFile` API if available. This API returns one
@@ -77,7 +77,7 @@ behavior is:
7777

7878
## PowerShell restrictions under lockdown policy
7979

80-
When PowerShell detects the system is under a WDAC lockdown policy, it applies restrictions even if
80+
When PowerShell detects the system is under a App Control lockdown policy, it applies restrictions even if
8181
the script is trusted and running in `FullLanguage` mode. These restrictions prevent known behaviors
8282
of PowerShell that could result in arbitrary code execution on a locked-down system. The lockdown
8383
policy enforces the following restrictions:
@@ -128,7 +128,7 @@ policy enforces the following restrictions:
128128

129129
## PowerShell restrictions under constrained language mode
130130

131-
Script or function that isn't approved by the WDAC policy is untrusted. When you run an untrusted
131+
Script or function that isn't approved by the App Control policy is untrusted. When you run an untrusted
132132
command, PowerShell either blocks the command from running (new behavior) or runs the command in
133133
`ConstrainedLanguage` mode. The following restrictions apply to `ConstrainedLanguage` mode:
134134

@@ -246,7 +246,7 @@ command, PowerShell either blocks the command from running (new behavior) or run
246246
## Further reading
247247

248248
- For more information about PowerShell language modes, see [about_Language_Modes][01].
249-
- For information about how to configure and use WDAC, see [How to use WDAC for PowerShell][03].
249+
- For information about how to configure and use App Control, see [How to use App Control for PowerShell][03].
250250

251251
<!-- link references -->
252252
[01]: /powershell/module/microsoft.powershell.core/about/about_language_modes

0 commit comments

Comments
 (0)