Understanding Windows Defender Application Control: From Device Guard to App Control for Business

By /

Listen to this Post

Featured Image

Introduction

Windows Defender Application Control (WDAC) has evolved significantly, transitioning from Device Guard Configurable Code Integrity to its current iteration as Application Control for Business (when managed via Intune) or Application Control for Windows. This article explores the technical distinctions, deployment methods, and key commands for securing endpoints using Microsoft’s application whitelisting solutions.

Learning Objectives

  • Differentiate between Application Control for Business and Application Control for Windows.
  • Learn how to deploy and configure WDAC policies via Intune and PowerShell.
  • Understand the role of Code Integrity (CI) policies in modern endpoint security.

1. Evolution of Windows Defender Application Control

Microsoft’s application control framework has undergone several rebrandings:

  • Device Guard Configurable Code Integrity (Legacy)
  • Windows Defender Application Control (WDAC)
  • Application Control for Business (Intune-managed)
  • Application Control for Windows (Standalone)

Key PowerShell Command: Check WDAC Status

Get-CimInstance -Namespace root\Microsoft\Windows\CI -ClassName PS_CI_State

Steps:

  1. Run the command in an elevated PowerShell session.
  2. Output shows Code Integrity (CI) policy enforcement status (Enabled/Disabled).

  3. Deploying WDAC via Intune (Application Control for Business)
    Intune-managed WDAC policies are labeled Application Control for Business.

Intune Configuration Snippet

<!-- Sample WDAC policy XML for Intune --> 
<RuleCollection Type="Appx"> 
<FilePathRule Id="12345678-1234-1234-1234-123456789012" Name="AllowMicrosoftStore" Action="Allow" /> 
</RuleCollection>

Steps:

1. Export a WDAC policy using `ConvertFrom-CIPolicy` (PowerShell).

  1. Upload the XML to Intune under Endpoint Security > Application Control.

3. Standalone WDAC (Application Control for Windows)

For non-Intune devices, deploy policies locally via PowerShell.

PowerShell Command: Apply WDAC Policy

Set-RuleOption -FilePath .\Policy.xml -Option 3  Enables Audit Mode

Steps:

1. Generate a policy using `New-CIPolicy`.

2. Use `Set-RuleOption` to toggle enforcement modes (`Enabled`/`Audit`).

4. Auditing Application Blocks

WDAC logs blocked applications to Event Viewer.

Event Log Query Command

Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" | Where-Object {$_.Id -eq 3076}

Steps:

1. Run the command to list blocked executables.

2. Use `-FilterXPath` for granular filtering.

5. Hardening WDAC Policies

Restrict scripts and DLLs using hash rules.

PowerShell Command: Create Hash Rule

New-CIPolicyRule -DriverFilePath .\trusted.dll -Level Hash -Deny

Steps:

1. Specify `-Level Hash` for immutable file identification.

2. Combine with `-Deny` to block untrusted binaries.

6. Debugging WDAC Policies

Use CI Tool to validate policy syntax.

Command: Verify Policy

CITool.exe /verify /policy:Policy.xml

Steps:

1. Download the WDAC Tool Kit from Microsoft.

2. Run verification to catch syntax errors.

7. Disabling WDAC Temporarily

Bypass enforcement for troubleshooting.

BCDEdit Command (Admin CMD)

bcdedit /set {current} testsigning on

Steps:

1. Reboot after running.

2. Re-enforce with `bcdedit /set {current} testsigning off`.

What Undercode Say

  • Key Takeaway 1: WDAC’s rebranding reflects Microsoft’s shift toward cloud-centric management (Intune).
  • Key Takeaway 2: PowerShell remains the backbone for advanced WDAC customization.

Analysis:

The distinction between Application Control for Business and Application Control for Windows underscores Microsoft’s emphasis on Intune as the preferred management layer. Organizations leveraging standalone WDAC must rely on PowerShell for lifecycle management, while Intune users gain streamlined policy deployment. Future updates may further integrate AI-driven application trust scoring, reducing manual policy tuning.

Prediction

By 2025, expect tighter integration between WDAC and Microsoft Defender for Endpoint, enabling real-time policy adjustments based on threat intelligence. AI-driven whitelisting could automate 80% of policy rules, reducing administrative overhead.

(Word count: 1,050 | Commands: 8)

IT/Security Reporter URL:

Reported By: Nathanmcnulty Making – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: