Event banner
Event details
Can't wait for this one. Still looking into a solution where we are able to disable user installs of for example Google Chrome, etc. I believe WDAC could be a potential option to tackle that.
- Jordan_Geurten
Microsoft
Hi Rob, I would be interested in hearing more about your scenario. At first glance, WDAC should meet your requirements. With WDAC, you can create a deny list to deny Chrome, for example, or an allow list to deny anything that is not explicitly on your list.- If you create a Intune Managed AAD joined environment using autopilot where the user becomes a normal user and use for example the default security baselines with some additional policies you wish, a user is still able to do user installs (like chrome or firefox). In an Enterprise Environment that is an absolute no-go because we don't manage those browsers. We only manage Edge and Edge works in most cases. I would like to be able to disable user installs in any form. It would be so nice to have that as a simple "flip the switch" policy instead of having a giant learning curve and administrative hassle that you get with WDAC or AppLocker. Me manage 100's of customer environments and the administration burden those solutions bring to the table are fairly large and costly.
- We use a third-party AV (Mcafee), is WDAC usable in this case or do we need to remove McAfee and switch to all defender to allow it to work?
- Most of WDAC features are part of Windows OS and those features are managed from Intune, Configuration Manager or GPO. You don't need to uninstall McAfee in order to work. Some Defender for endpoint (EDR) security remote tasks may use WDCA in order to enforce app execution restrictions.
- awesome, thankyou.
- Will per-user come to WDAC in the future? Right now we have to use applocker but I can see WDAC in some ways is more powerful?
- Jordan_GeurtenWDAC offers many more features and capabilities than AppLocker and is the recommended application control product over AppLocker. Per-user rules are on the roadmap for WDAC.
- Heather_Poulsen
Community Manager
- Heather_Poulsen
Welcome to Balancing security and flexibility when implementing Windows Defender Application Control (WDAC) at the Microsoft Technical Takeoff. Let's get started! Have a question? Post it here in the Comments. Subject matter experts will be answering during the session and throughout the week. We're looking forward to the conversation.
- I can't seem to post in the comments, so will reply here. Re: the use of Managed Installer and the Intelligent Security Graph, contrary to the video and the WDAC documentation, MI and ISG only work on Enterprise, not Pro. Is this a bug, or documentation oversight?
- Jeffrey_SutherlandISG has always worked on Pro. Managed installer has historically been restricted to Pro (due to AppLocker restriction), but that Edition restriction is being removed with servicing updates coming out later this month as a preview update and with the December patch Tuesday updates.
- Is there a private preview for the new management capabilities shown at approximately the 17 minute mark on the video?
Is there an advantage to configuring WDAC this way (manually) over using Intune or Configuration Manager?
- Jeffrey_Sutherland
The WDAC Wizard currently provides the best authoring experience. However, we will continue to improve the experience within Intune over time and further integrate with the WDAC client features to provide a more seamless and easier experience. You can also continue to deploy WDAC policy using ConfigMgr if that’s your preferred method.
- Heather_Poulsen
Don't be shy. This is a great forum to ask your questions, but also to share information about use cases and scenarios you need to support. Post now or anytime this week in the Comments.
- Is there any way to migrate from Applocker to WDAC?
- Jordan_GeurtenThere is an open-source tool which can be used to convert your AppLocker policies to WDAC policies at http://aka.ms/AppLockerPolicyConverter. I recommend parsing and testing the WDAC policy output.
- Heather_Poulsen
We’ll continue to answer questions here in the chat for the rest of the half hour and we’ll check back throughout the week. For bonus content, make sure to check out our Technical Takeoff Demo Channel!
Also, we’re so happy you’re here with us at the Microsoft Technical Takeoff! Whether you are attending one session or many, please take this 2-minute survey and let us know your thoughts on this event.
k_alekhyaI am aware that WDAC is a Windows feature. Are there any plans to support application control on macOS or Linux platforms through an agent?- Jeffrey_SutherlandAs we bring more application control features to Intune and Microsoft Defender for Endpoint (MDE), we will also consider how we can bring those capabilities to our non-Windows endpoints. The team that developed the WDAC capabilities on Windows have also been contributing to bring similar platform capabilities to Linux that we hope to see accepted soon by the broader Linux ecosystem https://microsoft.github.io/ipe/.
- My first time seeing this. The pace was fast. Although we can rewatch and pause the video, professional IT trainers don't use this presentation style tbh
