Skip to content

Commit 9f1ad36

Browse files
sdwheelersdwheeler
authored
Change WDAC to App Control (#11486)
1 parent 166792a commit 9f1ad36

File tree

6 files changed

+106
-97
lines changed

6 files changed

+106
-97
lines changed

‎redir/.openpublishing.redirection.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
{
22
"redirections": [
3+
{
4+
"redirect_document_id": true,
5+
"redirect_url": "/powershell/scripting/security/app-control/how-to-use-app-control",
6+
"source_path": "../reference/docs-conceptual/security/app-control/how-to-use-wdac.md"
7+
},
8+
{
9+
"redirect_document_id": true,
10+
"redirect_url": "/powershell/scripting/security/app-control/how-app-control-works",
11+
"source_path": "../reference/docs-conceptual/security/app-control/how-wdac-works.md"
12+
},
313
{
414
"redirect_document_id": true,
515
"redirect_url": "/powershell/scripting/security/preventing-script-injection",

‎reference/docs-conceptual/security/app-control/application-control.md‎

Lines changed: 51 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,84 @@
11
---
2-
description: This article explains the features of Windows using Windows Defender Application Control (WDAC) that can be used to secure your PowerShell environment.
3-
ms.date: 09/19/2024
4-
title: Use Windows Defender Application Control to secure PowerShell
2+
description: This article explains the features of Application Control that can be used to secure your PowerShell environment.
3+
ms.date: 10/21/2024
4+
title: Use App Control to secure PowerShell
55
---
6-
# Use Windows Defender Application Control to secure PowerShell
6+
# Use App Control to secure PowerShell
77

8-
Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][04] and
9-
[AppLocker][01] that you can use to control applications. They allow you to create a lockdown
10-
experience to help secure your PowerShell environment.
8+
Windows 10 includes two technologies, [App Control for Business][04] and [AppLocker][01],
9+
that you can use to control applications. They allow you to create a lockdown experience to help
10+
secure your PowerShell environment.
1111

1212
**AppLocker** builds on the application control features of Software Restriction Policies. AppLocker
1313
allows you to create rules to allow or deny apps for specific users or groups. You identify the apps
1414
based on unique properties of the files.
1515

16-
**WDAC**, introduced with Windows 10, allows you to control which drivers and applications are
17-
allowed to run on Windows.
16+
**Application Control for Business**, introduced in Windows 10 as Windows Defender Application
17+
Control (WDAC), allows you to control which drivers and applications are allowed to run on Windows.
1818

1919
## Lockdown policy detection
2020

21-
PowerShell detects both AppLocker and WDAC system wide policies. AppLocker doesn't have way to query
22-
the policy enforcement status. To detect if a system wide application control policy is being
23-
enforced by AppLocker, PowerShell creates two temporary files and tests if they can be executed. The
24-
filenames use the following name format:
21+
PowerShell detects both AppLocker and App Control for Business system wide policies. AppLocker
22+
doesn't have way to query the policy enforcement status. To detect if a system wide application
23+
control policy is being enforced by AppLocker, PowerShell creates two temporary files and tests if
24+
they can be executed. The filenames use the following name format:
2525

2626
- `$env:TEMP/__PSAppLockerTest__<random-8dot3-name>.ps1`
2727
- `$env:TEMP/__PSAppLockerTest__<random-8dot3-name>.psm1`
2828

29-
WDAC is the preferred application control system for Windows. WDAC provides APIs that allow you to
30-
discover the policy configuration. WDAC is designed as a security feature under the servicing
31-
criteria defined by the Microsoft Security Response Center (MSRC).
32-
33-
For more information about AppLocker and WDAC, see [Application Controls for Windows][04] and
34-
[WDAC and AppLocker feature availability][02].
29+
App Control for Business is the preferred application control system for Windows. App Control
30+
provides APIs that allow you to discover the policy configuration. App Control is designed as a
31+
security feature under the servicing criteria defined by the Microsoft Security Response Center
32+
(MSRC). For more information, see [Application Controls for Windows][04] and
33+
[App Control and AppLocker feature availability][02].
3534

3635
> [!NOTE]
37-
> When [choosing between WDAC or AppLocker][03], we recommend that you implement application control
38-
> using WDAC rather than AppLocker. Microsoft is continually improving WDAC and Microsoft management
39-
> platforms are extending their support for WDAC. Although AppLocker may continue to receive
40-
> security fixes, it won't receive feature enhancements.
36+
> When [choosing between App Control or AppLocker][03], we recommend that you implement application
37+
> control using App Control for Business rather than AppLocker. Microsoft is no longer investing in
38+
> AppLocker. Although AppLocker may continue to receive security fixes, it won't receive feature
39+
> enhancements.
4140
42-
## WDAC policy enforcement
41+
## App Control policy enforcement
4342

44-
When PowerShell runs under a WDAC policy, its behavior changes based on the defined security policy.
45-
Under a WDAC policy, PowerShell runs trusted scripts and modules allowed by the policy in
46-
`FullLanguage` mode. All other scripts and script blocks are untrusted and run in
43+
When PowerShell runs under an App Control policy, its behavior changes based on the defined security
44+
policy. Under an App Control policy, PowerShell runs trusted scripts and modules allowed by the
45+
policy in `FullLanguage` mode. All other scripts and script blocks are untrusted and run in
4746
`ConstrainedLanguage` mode. PowerShell throws errors when the untrusted scripts attempt to perform
4847
actions that aren't allowed in `ConstrainedLanguage` mode. It can be difficult to know why a script
4948
failed to run correctly in `ConstrainedLanguage` mode.
5049

51-
## WDAC policy auditing
50+
## App Control policy auditing
5251

53-
PowerShell 7.4 added a new feature to support WDAC policies in **Audit** mode. In audit mode,
52+
PowerShell 7.4 added a new feature to support App Control policies in **Audit** mode. In audit mode,
5453
PowerShell runs the untrusted scripts in `ConstrainedLanguage` mode without errors, but logs
5554
messages to the event log instead. The log messages describe what restrictions would apply if the
5655
policy were in **Enforce** mode.
5756

5857
## History of changes
5958

60-
Windows PowerShell 5.1 was the first version of PowerShell to support WDAC. The security features of
61-
WDAC and AppLocker improve with each new release of PowerShell. The following sections describe how
62-
this support changed in each version of PowerShell. The changes are cumulative, so the features
63-
described in the later versions include those from earlier versions.
59+
Windows PowerShell 5.1 was the first version of PowerShell to support App Control. The security
60+
features of App Control and AppLocker improve with each new release of PowerShell. The following
61+
sections describe how this support changed in each version of PowerShell. The changes are
62+
cumulative, so the features described in the later versions include those from earlier versions.
6463

6564
### Changes in PowerShell 7.4
6665

67-
On Windows, when PowerShell runs under a Windows Defender Application Control (WDAC) policy, its
68-
behavior changes based on the defined security policy. Under a WDAC policy, PowerShell runs trusted
69-
scripts and modules allowed by the policy in `FullLanguage` mode. All other scripts and script
70-
blocks are untrusted and run in `ConstrainedLanguage` mode. PowerShell throws errors when the
71-
untrusted scripts attempt to perform disallowed actions. It's difficult to know why a script fails
72-
to run correctly in `ConstrainedLanguage` mode.
66+
On Windows, when PowerShell runs under an App Control policy, its behavior changes based on the
67+
defined security policy. Under an App Control policy, PowerShell runs trusted scripts and modules
68+
allowed by the policy in `FullLanguage` mode. All other scripts and script blocks are untrusted and
69+
run in `ConstrainedLanguage` mode. PowerShell throws errors when the untrusted scripts attempt to
70+
perform disallowed actions. It's difficult to know why a script fails to run correctly in
71+
`ConstrainedLanguage` mode.
7372

74-
PowerShell 7.4 now supports WDAC policies in **Audit** mode. In audit mode, PowerShell runs the
75-
untrusted scripts in `ConstrainedLanguage` mode but logs messages to the event log instead of
73+
PowerShell 7.4 now supports App Control policies in **Audit** mode. In audit mode, PowerShell runs
74+
the untrusted scripts in `ConstrainedLanguage` mode but logs messages to the event log instead of
7675
throwing errors. The log messages describe what restrictions would apply if the policy were in
7776
**Enforce** mode.
7877

7978
### Changes in PowerShell 7.3
8079

81-
- PowerShell 7.3 now supports the ability to block or allow PowerShell script files via the WDAC
82-
API.
80+
- PowerShell 7.3 now supports the ability to block or allow PowerShell script files via the App
81+
Control API.
8382

8483
### Changes in PowerShell 7.2
8584

@@ -96,14 +95,14 @@ throwing errors. The log messages describe what restrictions would apply if the
9695

9796
## Further reading
9897

99-
- For more information about how WDAC works and what restrictions it enforces, see
100-
[How WDAC works with PowerShell][06].
101-
- For more information about securing PowerShell with WDAC, see [How to use WDAC][05].
98+
- For more information about how App Control works and what restrictions it enforces, see
99+
[How App Control works with PowerShell][06].
100+
- For more information about securing PowerShell with App Control, see [How to use App Control][05].
102101

103102
<!-- link references -->
104-
[01]: /windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
105-
[02]: /windows/security/threat-protection/windows-defender-application-control/feature-availability
106-
[03]: /windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview#choose-when-to-use-wdac-or-applocker
107-
[04]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
108-
[05]: how-to-use-wdac.md
109-
[06]: how-wdac-works.md
103+
[01]: /windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker
104+
[02]: /windows/security/application-security/application-control/app-control-for-business/feature-availability
105+
[03]: /windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview#choose-when-to-use-app-control-or-applocker
106+
[04]: /windows/security/application-security/application-control/app-control-for-business/appcontrol
107+
[05]: how-to-use-app-control.md
108+
[06]: how-app-control-works.md

‎reference/docs-conceptual/security/app-control/how-wdac-works.md‎ renamed to ‎reference/docs-conceptual/security/app-control/how-app-control-works.md‎

File renamed without changes.

‎reference/docs-conceptual/security/app-control/how-to-use-wdac.md‎ renamed to ‎reference/docs-conceptual/security/app-control/how-to-use-app-control.md‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
11
---
2-
description: This article explains how to configure and use WDAC to secure PowerShell.
3-
ms.date: 09/19/2024
4-
title: How to use WDAC to secure PowerShell
2+
description: This article explains how to configure and use App Control to secure PowerShell.
3+
ms.date: 10/21/2024
4+
title: How to use App Control to secure PowerShell
55
---
6-
# How to use WDAC to secure PowerShell
6+
# How to use App Control to secure PowerShell
77

8-
This article describes how to set up a **Windows Defender Application Control** (WDAC) policy. You
9-
can configure the policy to enforce or audit the policy's rule. In audit mode, PowerShell behavior
10-
doesn't change but it logs Event ID 16387 messages to the `PowerShellCore/Analytic` event log. In
11-
enforcement mode, PowerShell applies the policy's restrictions.
8+
This article describes how to set up a **App Control for Business** policy. You can configure the
9+
policy to enforce or audit the policy's rule. In audit mode, PowerShell behavior doesn't change but
10+
it logs Event ID 16387 messages to the `PowerShellCore/Analytic` event log. In enforcement mode,
11+
PowerShell applies the policy's restrictions.
1212

1313
This article assumes you're using a test machine so that you can test PowerShell behavior under a
14-
machine wide WDAC policy before you deploy the policy in your environment.
14+
machine wide App Control policy before you deploy the policy in your environment.
1515

16-
## Create a WDAC policy
16+
## Create an App Control policy
1717

18-
A WDAC policy is described in an XML file, which contains information about policy options, files
19-
allowed, and signing certificates recognized by the policy. When the policy is applied, only
18+
An App Control policy is described in an XML file, which contains information about policy options,
19+
files allowed, and signing certificates recognized by the policy. When the policy is applied, only
2020
approved files are allowed to load and run. PowerShell either blocks unapproved script files from
2121
running or runs them in `ConstrainedLanguage` mode, depending on policy options.
2222

23-
You create and manipulate WDAC policy using the **ConfigCI** module, which is available on all
24-
supported Windows versions. This Windows PowerShell module can be used in Windows PowerShell 5.1 or
25-
in PowerShell 7 through the **Windows Compatibility** layer. It's easier to use this module in
23+
You create and manipulate App Control policy using the **ConfigCI** module, which is available on
24+
all supported Windows versions. This Windows PowerShell module can be used in Windows PowerShell 5.1
25+
or in PowerShell 7 through the **Windows Compatibility** layer. It's easier to use this module in
2626
Windows PowerShell. The policy you create can be applied to any version of PowerShell.
2727

28-
## Steps to create a WDAC policy
28+
## Steps to create an App Control policy
2929

3030
For testing, you just need to create a default policy and a self signed code signing certificate.
3131

@@ -85,23 +85,23 @@ For testing, you just need to create a default policy and a self signed code sig
8585

8686
1. Convert the XML policy file to a policy enforcement binary file
8787

88-
Finally, you need to convert the XML file to a binary file used by WDAC to apply a policy.
88+
Finally, you need to convert the XML file to a binary file used by App Control to apply a policy.
8989

9090
```powershell
9191
ConvertFrom-CIPolicy -XmlFilePath .\SystemCIPolicy.xml -BinaryFilePath .\SIPolicy.p7b
9292
```
9393

94-
1. Apply the WDAC policy
94+
1. Apply the App Control policy
9595

9696
To apply the policy to your test machine, copy the `SIPolicy.p7b` file to the required system
9797
location, `C:\Windows\System32\CodeIntegrity`.
9898

9999
> [!NOTE]
100100
> Some policies definition must be copied to a subfolder such as
101101
> `C:\Windows\System32\CodeIntegrity\CiPolicies`. For more information, see
102-
> [WDAC Admin Tips & Known Issues][01].
102+
> [App Control Admin Tips & Known Issues][01].
103103
104-
1. Disable the WDAC policy
104+
1. Disable the App Control policy
105105

106106
To disable the policy, rename the `SIPolicy.p7b` file. If you need to do more testing, you can
107107
change the name back to reenable the policy.
@@ -110,9 +110,9 @@ For testing, you just need to create a default policy and a self signed code sig
110110
Rename-Item -Path .\SIPolicy.p7b -NewName .\SIPolicy.p7b.off
111111
```
112112

113-
## Test using WDAC policy auditing
113+
## Test using App Control policy auditing
114114

115-
PowerShell 7.4 added a new feature to support WDAC policies in **Audit** mode. In audit mode,
115+
PowerShell 7.4 added a new feature to support App Control policies in **Audit** mode. In audit mode,
116116
PowerShell runs the untrusted scripts in `ConstrainedLanguage` mode without errors, but logs
117117
messages to the event log instead. The log messages describe what restrictions would apply if the
118118
policy were in **Enforce** mode.
@@ -141,7 +141,7 @@ Get-WinEvent -LogName PowerShellCore/Analytic -Oldest |
141141
TimeCreated : 4/19/2023 10:11:07 AM
142142
ProviderName : PowerShellCore
143143
Id : 16387
144-
Message : WDAC Audit.
144+
Message : App Control Audit.
145145
146146
Title: Method or Property Invocation
147147
Message: Method or Property 'WriteLine' on type 'System.Console' invocation will not
@@ -153,7 +153,7 @@ Message : WDAC Audit.
153153
```
154154

155155
The event message includes the script position where the restriction would be applied. This
156-
information helps you understand where you need to change your script so that it runs under the WDAC
156+
information helps you understand where you need to change your script so that it runs under the App Control
157157
policy.
158158

159159
> [!IMPORTANT]
@@ -168,4 +168,4 @@ the audit event occurred. The breakpoint allows you to debug your code and inspe
168168
of the script in real time.
169169

170170
<!-- link references -->
171-
[01]: /windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues
171+
[01]: /windows/security/application-security/application-control/app-control-for-business/operations/known-issues

‎reference/docs-conceptual/security/overview.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ landingContent:
2020
links:
2121
- text: PowerShell security features
2222
url: security-features.md
23-
- text: Using Windows Defender Application Control
23+
- text: Using App Control for Business
2424
url: application-control.md
2525
- linkListType: how-to-guide
2626
links:
@@ -74,18 +74,18 @@ landingContent:
7474
url: remoting/jea/audit-and-report.md
7575

7676
# Card
77-
- title: Using WDAC
77+
- title: Using App Control
7878
linkLists:
7979
- linkListType: overview
8080
links:
81-
- text: Using Windows Defender Application Control
81+
- text: Using App Control for Business
8282
url: app-control/application-control.md
83-
- text: How WDAC works with PowerShell
84-
url: app-control/how-wdac-works.md
83+
- text: How App Control works with PowerShell
84+
url: app-control/how-app-control-works.md
8585
- linkListType: how-to-guide
8686
links:
87-
- text: How to use WDAC to secure PowerShell
88-
url: app-control/how-to-use-wdac.md
87+
- text: How to use App Control to secure PowerShell
88+
url: app-control/how-to-use-app-control.md
8989

9090
# Card
9191
- title: Managing secrets

‎reference/docs-conceptual/security/security-features.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,17 @@ a PowerShell session. For a full description, see [about_Language_Modes][04].
6464

6565
## Application Control
6666

67-
Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][08] and
68-
[AppLocker][07] that you can use to control applications. PowerShell detects if a system wide
69-
application control policy is being enforced. The policy applies certain behaviors when running
70-
script blocks, script files, or loading module files to prevent arbitrary code execution on the
71-
system.
67+
Windows 10 includes two technologies, [App Control for Business][08] and [AppLocker][07] that you
68+
can use to control applications. PowerShell detects if a system wide application control policy is
69+
being enforced. The policy applies certain behaviors when running script blocks, script files, or
70+
loading module files to prevent arbitrary code execution on the system.
7271

73-
WDAC is designed as a security feature under the servicing criteria defined by the Microsoft
74-
Security Response Center (MSRC). WDAC is the preferred application control system for Windows.
72+
App Control for Business is designed as a security feature under the servicing criteria defined by
73+
the Microsoft Security Response Center (MSRC). App Control is the preferred application control
74+
system for Windows.
7575

76-
For more information about how PowerShell supports AppLocker and WDAC, see
77-
[Using Windows Defender Application Control][10].
76+
For more information about how PowerShell supports AppLocker and App Control, see
77+
[Use App Control to secure PowerShell][10].
7878

7979
## Software Bill of Materials (SBOM)
8080

@@ -98,8 +98,8 @@ features meet the criteria for servicing.
9898

9999
Security features
100100

101-
- System Lockdown with WDAC
102-
- Constrained language mode with WDAC
101+
- System Lockdown with App Control for Business
102+
- Constrained language mode with App Control for Business
103103

104104
Defense in depth features
105105

@@ -114,8 +114,8 @@ Defense in depth features
114114
[04]: /powershell/module/microsoft.powershell.core/about/about_language_modes
115115
[05]: /powershell/module/microsoft.powershell.core/about/about_logging_non-windows
116116
[06]: /powershell/module/microsoft.powershell.core/about/about_logging_windows
117-
[07]: /windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
118-
[08]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
117+
[07]: /windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker
118+
[08]: /windows/security/application-security/application-control/app-control-for-business/appcontrol
119119
[09]: /windows/win32/amsi/how-amsi-helps
120120
[10]: app-control/application-control.md
121121
[11]: https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/

0 commit comments

Comments
 (0)