Forum Discussion
WDAC Lightly managed devices policy
- Oct 27, 2023
In case you missed it, Microsoft stated in a previous post about Windows 11 22H2 that Smart App policies would only deploy to a device that was a fresh install. At the same time, I haven't checked in either case (though also not present in my directories (here: C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml). Likely, the policy does not exist because I am not on a fresh install. Are you looking for a device that has a fresh install of Win11 22H2?
Regardless, you don't need that one. If you have some form of management or can use Intune's WDAC policy (currently in preview) with its managed installer, you could implement it without worrying about getting the policy onto devices. Another approach is to run a PowerShell script that echoes the content into a file in the appropriate directly. To make it easier, you should encode the contents into Base64 as a variable and then have the script decode it as it echoes into the file.
Back to the policy. Suppose you don't have SmartAppControl.xml; the good news is that all that policy contains is a profile you can make with the WDAC wizard. You can find the app provided by Microsoft below:
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard
Just in case it disappears from that page and you find a 404 in the future, here is a direct link below:
https://webapp-wdac-wizard.azurewebsites.net/
Further, here is a list of the sources for the WDAC Wizard repo:
https://github.com/MicrosoftDocs/WDAC-Toolkit
Finally, the Smart App XML policy is nearly identical to the policy generated using the WDAC wizard and selecting the "Signed and Reputable Mode." I wish I added a picture. I can edit. I will check after I post.) Play around with it and have fun.
I hope my reply meets your expectations.
Stay safe, and good luck!