Skip to content

Corrected the names referring to WDAC to use App Control #11481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 21, 2024
Merged

Corrected the names referring to WDAC to use App Control #11481

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e78be64
WDAC is now App Control
HotCakeX Oct 18, 2024
e8fe453
Update how-wdac-works.md
HotCakeX Oct 18, 2024
e249bd9
Apply suggestions from code review
sdwheeler Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions reference/docs-conceptual/security/app-control/how-wdac-works.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,31 @@
---
description: This article explains how WDAC works to secure PowerShell and the restrictions it imposes.
description: This article explains how App Control for Business works to secure PowerShell and the restrictions it imposes.
ms.date: 09/19/2024
title: How WDAC works with PowerShell
title: How App Control for Business works with PowerShell
---
# How WDAC works with PowerShell
# How App Control works with PowerShell

This article explains how **Windows Defender Application Control** (WDAC) secures PowerShell and the
This article explains how **App Control for Business** secures PowerShell and the
restrictions it imposes. The secure behavior of PowerShell varies based on the version of Windows
and PowerShell you're using.

## How PowerShell detects a system lockdown policy

PowerShell detects both **AppLocker** and **Windows Defender Application Control** (WDAC) system
wide polices. AppLocker is deprecated. WDAC is the preferred application control system for Windows.
PowerShell detects both **AppLocker** and **App Control for Business** system
wide polices. AppLocker is deprecated. App Control is the preferred application control system for Windows.

### Legacy WDAC policy enforcement detection
### Legacy App Control policy enforcement detection

PowerShell uses the legacy WDAC `WldpGetLockdownPolicy` API to discover two things:
PowerShell uses the legacy App Control `WldpGetLockdownPolicy` API to discover two things:

- System wide policy enforcement: `None`, `Audit`, `Enforce`
- Individual file policy: `None`, `Audit` (allowed by policy), `Enforce` (not allowed by policy)

All versions of PowerShell (v5.1 - v7.x) support this WDAC policy detection.
All versions of PowerShell (v5.1 - v7.x) support this App Control policy detection.

### Latest WDAC policy enforcement detection
### Latest App Control policy enforcement detection

WDAC introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
App Control introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
the new `WldpCanExecuteFile` API to decide how a file should be handled. Windows PowerShell 5.1
doesn't support this new API. The new API takes precedence over the legacy API for individual files.
However, PowerShell continues to use the legacy API to get the system wide policy configuration. If
Expand Down Expand Up @@ -54,7 +54,7 @@ this mode, see the [PowerShell restrictions under lockdown policy][02] section o

### Noninteractive mode running under policy enforcement

When PowerShell runs a script or loads a module, it uses the WDAC API to get the policy enforcement
When PowerShell runs a script or loads a module, it uses the App Control API to get the policy enforcement
for the file.

PowerShell version 7.3 or higher uses the `WldpCanExecuteFile` API if available. This API returns one
Expand All @@ -77,7 +77,7 @@ behavior is:

## PowerShell restrictions under lockdown policy

When PowerShell detects the system is under a WDAC lockdown policy, it applies restrictions even if
When PowerShell detects the system is under a App Control lockdown policy, it applies restrictions even if
the script is trusted and running in `FullLanguage` mode. These restrictions prevent known behaviors
of PowerShell that could result in arbitrary code execution on a locked-down system. The lockdown
policy enforces the following restrictions:
Expand Down Expand Up @@ -128,7 +128,7 @@ policy enforces the following restrictions:

## PowerShell restrictions under constrained language mode

Script or function that isn't approved by the WDAC policy is untrusted. When you run an untrusted
Script or function that isn't approved by the App Control policy is untrusted. When you run an untrusted
command, PowerShell either blocks the command from running (new behavior) or runs the command in
`ConstrainedLanguage` mode. The following restrictions apply to `ConstrainedLanguage` mode:

Expand Down Expand Up @@ -246,7 +246,7 @@ command, PowerShell either blocks the command from running (new behavior) or run
## Further reading

- For more information about PowerShell language modes, see [about_Language_Modes][01].
- For information about how to configure and use WDAC, see [How to use WDAC for PowerShell][03].
- For information about how to configure and use App Control, see [How to use App Control for PowerShell][03].

<!-- link references -->
[01]: /powershell/module/microsoft.powershell.core/about/about_language_modes
Expand Down