0

On Windows 11, I made a WDAC policy with WDAC Wizard and added it to Group Policy, restarted the PC and still the policy isn't being enforced.

Here is the test policy I made:

<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Advanced Boot Options Menu</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Update Policy No Reboot</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Dynamic Code Security</Option>
    </Rule>
  </Rules>
  <!--EKUS-->
  <EKUs>
    <EKU ID="ID_EKU_STORE" Value="010a2b0601040182374c0301" FriendlyName="Windows Store EKU - 1.3.6.1.4.1.311.76.3.1 Windows Store" />
  </EKUs>
  <!--File Rules-->
  <FileRules>
    <FileAttrib ID="ID_FILEATTRIB_F_1_0_0" FriendlyName="C:\Program Files\CrystalDiskMark8\DiskMark64.exe FileAttribute" FileName="DiskMark.exe" MinimumFileVersion="8.0.4.0" />
    <FileAttrib ID="ID_FILEATTRIB_REFRESH_POLICY_1" FriendlyName="RefreshPolicy.exe FileAttribute" FileName="RefreshPolicy.exe" MinimumFileVersion="10.0.19042.0" />
  </FileRules>
  <!--Signers-->
  <Signers>
    <Signer ID="ID_SIGNER_F_1_0_0" Name="Certum Code Signing CA SHA2">
      <CertRoot Type="TBS" Value="F7B6EEB3A567223000A61F68C53B458193557C17E5D512D2825BCB13E5FC9BE5" />
      <CertPublisher Value="Open Source Developer, Noriyuki Miyazaki" />
      <FileAttribRef RuleID="ID_FILEATTRIB_F_1_0_0" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_1997_1" Name="MincryptKnownRootMicrosoftProductRoot1997">
      <CertRoot Type="Wellknown" Value="04" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_2001_1" Name="MincryptKnownRootMicrosoftProductRoot2001">
      <CertRoot Type="Wellknown" Value="05" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_2010_1" Name="MincryptKnownRootMicrosoftProductRoot2010">
      <CertRoot Type="Wellknown" Value="06" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_STANDARD_2011_1" Name="MincryptKnownRootMicrosoftStandardRoot2011">
      <CertRoot Type="Wellknown" Value="07" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_CODEVERIFICATION_2006_1" Name="MincryptKnownRootMicrosoftCodeVerificationRoot2006">
      <CertRoot Type="Wellknown" Value="08" />
    </Signer>
    <Signer ID="ID_SIGNER_DRM_1" Name="MincryptKnownRootMicrosoftDMDRoot2005">
      <CertRoot Type="Wellknown" Value="0C" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_FLIGHT_2014_1" Name="MincryptKnownRootMicrosoftFlightRoot2014">
      <CertRoot Type="Wellknown" Value="0E" />
    </Signer>
    <Signer ID="ID_SIGNER_TEST2010_1" Name="MincryptKnownRootMicrosoftTestRoot2010">
      <CertRoot Type="Wellknown" Value="0A" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_1997_UMCI_1" Name="MincryptKnownRootMicrosoftProductRoot1997">
      <CertRoot Type="Wellknown" Value="04" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_2001_UMCI_1" Name="MincryptKnownRootMicrosoftProductRoot2001">
      <CertRoot Type="Wellknown" Value="05" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_PRODUCT_2010_UMCI_1" Name="MincryptKnownRootMicrosoftProductRoot2010">
      <CertRoot Type="Wellknown" Value="06" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_STANDARD_2011_UMCI_1" Name="MincryptKnownRootMicrosoftStandardRoot2011">
      <CertRoot Type="Wellknown" Value="07" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_CODEVERIFICATION_2006_UMCI_1" Name="MincryptKnownRootMicrosoftCodeVerificationRoot2006">
      <CertRoot Type="Wellknown" Value="08" />
    </Signer>
    <Signer ID="ID_SIGNER_DRM_UMCI_1" Name="MincryptKnownRootMicrosoftDMDRoot2005">
      <CertRoot Type="Wellknown" Value="0C" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_FLIGHT_2014_UMCI_1" Name="MincryptKnownRootMicrosoftFlightRoot2014">
      <CertRoot Type="Wellknown" Value="0E" />
    </Signer>
    <Signer ID="ID_SIGNER_STORE_1" Name="Microsoft MarketPlace PCA 2011">
      <CertRoot Type="TBS" Value="FC9EDE3DCCA09186B2D3BF9B738A2050CB1A554DA2DCADB55F3F72EE17721378" />
      <CertEKU ID="ID_EKU_STORE" />
    </Signer>
    <Signer ID="ID_SIGNER_MICROSOFT_REFRESH_POLICY_1" Name="Microsoft Code Signing PCA 2011">
      <CertRoot Type="TBS" Value="F6F717A43AD9ABDDC8CEFDDE1C505462535E7D1307E630F9544A2D14FE8BF26E" />
      <CertPublisher Value="Microsoft Corporation" />
      <FileAttribRef RuleID="ID_FILEATTRIB_REFRESH_POLICY_1" />
    </Signer>
    <Signer ID="ID_SIGNER_TEST2010_UMCI_1" Name="MincryptKnownRootMicrosoftTestRoot2010">
      <CertRoot Type="Wellknown" Value="0A" />
    </Signer>
  </Signers>
  <!--Driver Signing Scenarios-->
  <SigningScenarios>
    <SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_DRIVERS_1" FriendlyName="Auto generated policy on 09-09-2022">
      <ProductSigners>
        <AllowedSigners>
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_1997_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_2001_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_2010_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_STANDARD_2011_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_CODEVERIFICATION_2006_1" />
          <AllowedSigner SignerId="ID_SIGNER_DRM_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_FLIGHT_2014_1" />
          <AllowedSigner SignerId="ID_SIGNER_TEST2010_1" />
        </AllowedSigners>
      </ProductSigners>
    </SigningScenario>
    <SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="Auto generated policy on 09-09-2022">
      <ProductSigners>
        <DeniedSigners>
          <DeniedSigner SignerId="ID_SIGNER_F_1_0_0" />
        </DeniedSigners>
        <AllowedSigners>
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_1997_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_2001_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_PRODUCT_2010_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_STANDARD_2011_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_CODEVERIFICATION_2006_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_DRM_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_FLIGHT_2014_UMCI_1" />
          <AllowedSigner SignerId="ID_SIGNER_STORE_1" />
          <AllowedSigner SignerId="ID_SIGNER_MICROSOFT_REFRESH_POLICY_1" />
          <AllowedSigner SignerId="ID_SIGNER_TEST2010_UMCI_1" />
        </AllowedSigners>
      </ProductSigners>
    </SigningScenario>
  </SigningScenarios>
  <UpdatePolicySigners />
  <CiSigners>
    <CiSigner SignerId="ID_SIGNER_F_1_0_0" />
    <CiSigner SignerId="ID_SIGNER_STORE_1" />
    <CiSigner SignerId="ID_SIGNER_MICROSOFT_REFRESH_POLICY_1" />
  </CiSigners>
  <HvciOptions>0</HvciOptions>
  <Settings>
    <Setting Provider="AllHostIds" Key="{0468C085-CA5B-11D0-AF08-00609797F0E0}" ValueName="EnterpriseDefinedClsId">
      <Value>
        <Boolean>true</Boolean>
      </Value>
    </Setting>
    <Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
      <Value>
        <String>DefaultMicrosoftEnforced</String>
      </Value>
    </Setting>
    <Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
      <Value>
        <String>022422</String>
      </Value>
    </Setting>
  </Settings>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
</SiPolicy>

Then I added a test program to the deny list to see if the policy is enforced after computer restart

Screenshot of WDAC Wizard deny list

after that I used this command

ConvertFrom-CIPolicy -XmlFilePath C:\Users\UserName\OneDrive\Desktop\policy.xml -BinaryFilePath C:\Windows\System32\CodeIntegrity\SIPolicy.p7b

to create the SIPolicy.p7b file from the XML file that WDAC Wizard gave me, and then I added it to Group Policy like this:

Group Policy screenshot

any Idea what I'm missing to get it to work? I restarted multiple times but all of the non-Microsoft and 3rd party programs are still running and that program that I specifically added to the deny list can run as well.

here is related part of System information

system information screenshot

1 Answer 1

0

I've created complete guides on my GitHub, using Microsoft references only, about how to create and deploy (and cryptographically sign) a WDAC - Windows Defender Application Control - policy.

Based on the info you provided, I'd say the problem is 1) you're using a single policy format instead of multiple policy format and 2) after creating the .cip binary file for multiple policy format, copy it to C:\Windows\System32\CodeIntegrity\CiPolicies\Active and restart the device.


What is Windows Defender Application Control?

Application control is a crucial line of defense for protecting enterprises given today's threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control moves away from an application trust model where all applications are assumed trustworthy to one where applications must earn trust in order to run.

Devices where Windows Defender Application control (WDAC) policies are deployed on can either be centrally managed via MDM, Intune etc. or they can be home devices, devices that are private and don't belong to any organization, the computer of someone that you want to keep 100% safe and secure so that even the device's owner can't willingly or forcefully compromise themselves, the possibilities are endless.


Windows Defender Application Control (WDAC) wiki posts


My WDACConfig Module

WDACConfig is an advanced PowerShell module designed with the aim of automating Application and File whitelisting in Windows using Windows Defender Application Control. Install it from PowerShell gallery.


WDAC usage levels

There are many ways you can utilize WDAC features and here they are sorted by the level of restriction and protection they provide; From top (having the least restriction and protection) to bottom (having the most restriction and protection).

  1. Use Microsoft recommended driver block rules.

  2. Update Microsoft recommended driver block rules outside of the twice a year schedule.

  3. Use Microsoft recommended block rules PLUS Recommended driver block rules

  4. Create WDAC policy for Lightly managed devices

  5. Use Smart App Control

    • It's just a toggle in Windows Security under App & Browser control. It uses a special kind of WDAC policy that provides more protection than a lightly managed workstation but less protection than a fully managed workstation.
    • It uses both of Microsoft's recommended block rules.
  6. Create WDAC policy for Fully managed devices


Methods we can use to create a WDAC policy


Plan for Windows Defender Application Control lifecycle policy management

Microsoft provides the following official document to understand the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies. The rest of them are mentioned below at the Resources section.


Resources

There are a lot more WDAC resources and cmdlets available on Microsoft's websites.

Cmdlets

Documents


You must log in to answer this question.