Supplemental WDAC policy Doesn't Override Block Rule from Base WDAC Policy (Microsoft Recommended Block Rules)

Question

I'm working on creating a Windows Defender Application Control (WDAC) supplemental policy which supplements a base policy. The base policy is merged with the Microsoft Recommended Block Rules. This means that the base policy blocks WSL.exe (Windows Subsystem for Linux) by default.

<Deny ID="ID_DENY_WSL_1_0" FriendlyName="wsl.exe" FileName="wsl.exe" MinimumFileVersion="0.0.0.0" MaximumFileVersion="65355.65355.65355.65355" />

Microsoft officially states that "Files that are allowed by either the base policy or the supplemental policy aren't blocked". So, what I'm trying to do is allow WSL in the supplemental policy. However, for the three supplemental policies I've tried creating, WSL is still being blocked. I've tried to allow WSL by Hash, and by FileName (FileName is how it is blocked in the base policy.)

Here are some of the options / XML snippets in the supplemental policies I've created:

Supplemental Policy 1:

<!--Rules section Empty for this one-->
<Rules />

<FileRules>
   <Allow ID="ID_ALLOW_A_A0" FriendlyName="%OSDRIVE%\Windows\System32\wsl.exe Hash Sha256" Hash="CBDD7637A5E15F9A97CE2D94D2AD1557CAD51482C43D13836FB15686DD143276" />
   <Allow ID="ID_ALLOW_A_A1" FriendlyName="%OSDRIVE%\Program Files\WSL\wslhost.exe Hash Sha256" Hash="F5B963957EF92B833DFF05D17AEA9B71FC3939BBD91749672DBB69A75466FA89" />
</FileRules>

<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="Auto generated policy on 11-17-2023">
    <ProductSigners>
      <FileRulesRef>
        <FileRuleRef RuleID="ID_ALLOW_A_A0" />
        <FileRuleRef RuleID="ID_ALLOW_A_A1" />
      </FileRulesRef>
    </ProductSigners>
</SigningScenario>

Supplemental Policy 2:

<Rules>
  <Rule>
    <Option>Enabled:UMCI</Option>
  </Rule>
</Rules>

  <FileRules>
     <Allow ID="ID_ALLOW_A_1_0_0" FriendlyName="C:\Windows\System32\wsl.exe Hash Sha1" Hash="FC085F2DC1905756BAE4A0214483C37BDEAE61AC" />
     <Allow ID="ID_ALLOW_A_2_0_0" FriendlyName="C:\Windows\System32\wsl.exe Hash Sha256" Hash="CBDD7637A5E15F9A97CE2D94D2AD1557CAD51482C43D13836FB15686DD143276" />
     <Allow ID="ID_ALLOW_A_3_0_0" FriendlyName="C:\Windows\System32\wsl.exe Hash Page Sha1" Hash="0AD1F7968A49FD372E319E79F01D23D8DCAE331A" />
     <Allow ID="ID_ALLOW_A_4_0_0" FriendlyName="C:\Windows\System32\wsl.exe Hash Page Sha256" Hash="30D8D7D71B0FB2EB24CCD0CFEED91AF2D7719B50E58BBD515C6463CF9D915FA4" />
  </FileRules>

<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="Auto generated policy on 11-17-2023">
      <ProductSigners>
        <FileRulesRef>
          <FileRuleRef RuleID="ID_ALLOW_A_1_0_0" />
          <FileRuleRef RuleID="ID_ALLOW_A_2_0_0" />
          <FileRuleRef RuleID="ID_ALLOW_A_3_0_0" />
          <FileRuleRef RuleID="ID_ALLOW_A_4_0_0" />
        </FileRulesRef>
      </ProductSigners>
    </SigningScenario>
  </SigningScenarios>

Supplemental Policy 3:

<Rules>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
  </Rules>
<FileRules>
    <Allow ID="ID_ALLOW_A_0_0_1" FriendlyName="Allow files based on file attributes: wsl.exe and wsl.exe" FileName="wsl.exe" InternalName="wsl.exe" />
  </FileRules>
<!--Driver Signing Scenarios-->
  <SigningScenarios>
    <SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_DRIVERS_1" FriendlyName="Auto generated policy on 11-17-2023">
      <ProductSigners>
        <FileRulesRef>
          <FileRuleRef RuleID="ID_ALLOW_A_0_0_1" />
        </FileRulesRef>
      </ProductSigners>
    </SigningScenario>
    <SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="Auto generated policy on 11-17-2023">
      <ProductSigners>
        <FileRulesRef>
          <FileRuleRef RuleID="ID_ALLOW_A_0_0_1" />
        </FileRulesRef>
      </ProductSigners>
    </SigningScenario>
  </SigningScenarios>

It's worth noting that the last 2 supplemental policies were partially created with the help of the WDAC Wizard.

Note also that the base policy and the supplemental policies are all signed WDAC policies.

Things I've Tried:

1. I've verified that the policies are being refreshed and activated, by verifying the presence of event ID 3099 in the Event Viewer (Located at Application and Services Logs > Microsoft > Windows > CodeIntegrity)

2. I've verified that the policies are being signed correctly, and put in the EFI partition correctly. (Base policy works just fine.) I'm using ConvertFrom-CIPolicy in PowerShell to convert the .XML files to .CIP files. I'm using the SignTool to sign the policies, making sure to rename them back to .CIP files.

3. I've checked that the base policy allows supplemental policies (i.e., verified the presence of "Enabled:Allow Supplemental Policies"), and contains SupplementalPolicySigners and UpdatePolicySigners. (Other options enabled in the base policy include: "Enabled:Advanced Boot Options Menu","Enabled:UMCI","Enabled:Update Policy No Reboot","Required:WHQL","Required:Enforce Store Applications","Enabled:Dynamic Code Security")

4. I've rebooted my device several times and used the official Microsoft Refresh Policy tool several times. Secure boot is enabled on my device.

5. I've tried toggling on and off the Hypervisor-Protected-Code-Integrity option for the supplemental policies (using Set-HVCIOptions in PowerShell.) HVCI is enabled within the base policy.

6. One weird quirk I noticed is that if you add WSL.exe using the WDAC Wizard and select File Attributes, that the FileName shows as "WSL.exe.mui", so I tried creating supplemental policies with and without this particular OriginalFileName (i.e., WSL.exe.mui AND WSL.exe).

7. I even tried adding a filepath rule to allow everything in System32 and even that didn't seem to work:

   <Allow ID="ID_ALLOW_PATH_0_0_1" FriendlyName="Allow by path: " FilePath="%SYSTEM32%\*" />
   

I am running on Windows 10 Pro 22H2.

Answer 1

The answer--I've found--is that while it's possible to allow an implicitly denied application in a supplemental policy (for example, an app which was not included in a deny-all base WDAC policy), you cannot override an explicitly denied application with a supplemental policy. Source from @SpyNet's site: "When the base policy has a deny rule for a file and we allow the same file in a supplemental policy, the file will still be blocked, because explicit deny rules have the highest priority."

Microsoft will have to clarify their wording on the article mentioned in the original question.