Enable Windows Defender Application Control with Microsoft Intune

Microsoft have just made it easier to get started with Windows Defender App Control, the next iteration of Applocker
I’m a big fan of WDAC - it’s one of the most effective security controls to prevent ransomware attacks, as it ensures only approved apps can be run on devices.
In this video we walk through how WDAC can be implemented directly from Microsoft Intune's Endpoint Security blade.

[@andrewmccallum5699]

Thanks Dean, WDAC is a complex & tricky area to work on, appreciate you going through the changes (it's very much a tough nut to crack) top effort!

[@DeanEllerbyMVP]

Thanks Andrew!

[@ifmclaren]

Thanks for this. I enabled IME as the managed installer in our tenant last night (previously there's been no managed installer configured), and today I'm seeing roughly 50/50 successful and failed assignments. I'm hoping the failed ones will fix themselves in due course.

[@pocketman5510]

What's the difference between this, and a device configuration profile > endpoint security template? Do I need to configure it this was first?

[@Nobody_Cares_In_Brazil]

Thanks for sharing 👍

[@DeanEllerbyMVP]

Thanks for watching!

[@HenkStoop]

Hi! you are talking about security risks of deploying the managed installer of Intune, which allows apps from Intune. What are those security risks?

[@markp8564]

Awesome content. Is there any other way to see audit events without using local or advanced threat hunting? i cant see where they are reported in intune/defender

[@alanrahal7306]

You are awesome, Thanks

[@DeanEllerbyMVP]

Thanks!

[@DanL57]

I also installed WDAC with the signed and reputable mode using the wizard. If the settings button is clicked on the wizard the Microsoft recommended block rules can be added to the policy.

[@jujigatame4800]

Thanks for the video. Can you advise where to view the reports when configured in audit mode?

[@Artakra2008]

Thanks Dean.
Question. If we want to also look at implementing Endpoint Priviledge Management, is there a way to integrate this with WDAC, so that for example certain departments that require a specialised application use, we would be able to set up an EPM rule allowing them to run their specialised programs as evaluated users, that would then bypass the block policy? Or allow them to run the application.
Trying to avoid having an exclude list on our companies universal block policy in WDAC, but come up with a solution to allow departments to run their specialised software without throwing it on the allowed XML list so that any user can run the software.

[@DeanEllerbyMVP]

You're welcome.
No, that's not possible - yet.
I have no firm information on this, but the interface and structure they've used for EPM would work very well for a future version of WDAC. I'm guessing, but that's what I'd be looking for in the next year or so!

[@Hichken]

Hi can you talk about Defender app guard

[@RobertCollinson-rt7lc]

I like that you can deploy the XML with Intune to give more of a centralised deployment, but I can't say I'm a fan of having to use an XML really. It would be nice to add the rules directly into Intune like you can with ASR rules. What's the cleanest way of keeping on top of your XML files

[@DeanEllerbyMVP]

I agree, it's not perfect but it's good to see some investment being made in WDAC.
As for managing XML, that's usually decided on a case-by-case basis. I work with many customers who all have their own repositories or preferences when it comes to maintaining consistent code.

[@premiumtube4281]

Thanks for the vid Dean. I want to enable wdac in audit mode, where are the logs stored?

[@DeanEllerbyMVP]

You’re welcome. The logs are stored in the Event Log on each client. Application and Services > Microsoft > Windows > CodeIntegrity > Operational

[@ToTCaMbIu]

Great explanation! Any idea how one configures WDAC to be able to override it with a local admin account? e.g. install one single application for a single machine. Similar to what is possible with AppLocker.

[@DeanEllerbyMVP]

Sure - WDAC was designed as an 'addon' to AppLocker to solve the workaround where an Admin could override the protections, so no - there doesn't appear to be that option in WDAC.

[@gauravmohanty1674]

I uploaded XML policy(Created from WDAC wizard) and Company Portal as Managed Installer also success. Still Apps installed from Company Portal are getting blocked. Any Suggesations?

[@DeanEllerbyMVP]

Only apps installed after the policy applied will be reported as installed by a managed installer. Does that help?

[@hamzamir786]

@@DeanEllerbyMVP i tried installing app after forcing the policy via Company Portal which was only made available (packaged) via Intune before policy was pushed. But its still saying those are voilating the Code integrity policy in audit mode. However, i have gone through and chose least possible controls when creating XML via WDAC wizard i guess its just because there may have some tricks and tips while using WDAC for (Multiple) creating Base and Supplimental policies to deploy via Intune.
Have been following you and other online platforms to see if thers a brief tutorial on how to create correct XML via WDAC wizard or what to keep in mind when deploying App control policy via Application control in Endpoint Security. I am assuming i am just one step behind to make it scuccessful. Thank you for your assistance like always.