Using Windows Application Control via an Intune template

In this video you'll see how to apply Windows Application Control using a standard Intune Endpoint Protection policy. You'll also see how you can use the Microsoft Intelligent Security Graph to also allow 'trusted applications' to run in your environment. Finally, there are are some tips and tricks with this process that will also be shared.

[@alanrahal7306]

Thanks Robert, nice and easy to understand

[@ToTCaMbIu]

Great explanation! Any idea how one configures WDAC to be able to override it with a local admin account? e.g. install one single application for a single machine. Similar to what is possible with AppLocker.

[@directorcia]

WDAC is a device NOT user policy. If you want a user policy use AppLocker. WDAC because it is a device policy is far more secure.

[@muhammadhassansiddiqui9129]

Hi Robert, can we allow only notepad to a user and apply only to the user's group

[@directorcia]

Yes

[@fbifido2]

How can you enable Windows Application Control, plus allow your LOB apps, be it either 32bit or 64bit?

[@directorcia]

You will probably need to use a more granular control like custom WDAC policies. But it can be done but custom apps probably need a custom WDAC policy, which can still be deployed via Intune. See my other videos on that here.

[@GregThomson]

@directorcia might be worth a video?

[@directorcia]

@@GregThomson sorry, far too complicated. Besides that’s WDAC and I have already done a video on that.

[@jameseduard2092]

awesome video guide, how can we manage to control on specific application to block only?

[@directorcia]

Create a custom policy

[@jameseduard2092]

@@directorcia awesome thanks, do you have any guide sir, like for example we only want to block only specific apps like brave browser or we can specify which app is block, and not only the trusted Microsoft apps is it possible?

[@directorcia]

@@jameseduard2092 Sorry, no. I suggest you consult the MS docs.

[@clivebuckwheat]

Can you do a white list of trusted apps for your organization?

[@directorcia]

Yes

[@clivebuckwheat]

@@directorcia how would I do this?

[@directorcia]

@@clivebuckwheatI suggest you review the MS docs. Basically instead of a line in the XML file blocking an app you'd have one allowing the app. Provided the software has a cert you could do it by public cert.

[@clivebuckwheat]

@@directorcia So blocking Apps would be much easier I have too much to white list, on your opinion?

[@directorcia]

@@clivebuckwheat I block known/unknown bad apps rather than allowing good apps. Far easier yes.