Windows Defender Application Guard Standalone mode

[Yolando Pereira]

Many businesses worldwide have come under increasing threat of targeted attacks, where attackers are crafting specialized attacks against a particular business, attempting to take control of corporate networks and data. For the most security-conscience businesses, we are introducing a new layer of defense-in-depth protection: Windows Defender Application Guard for Windows 10 Enterprise. Application Guard provides unprecedented protection against targeted threats using Microsoft's industry leading Hyper-V virtualization technology. In the upcoming release of Windows, we have built experiences around the Microsoft Edge browser that allow users or organizations to launch Microsoft Edge in a Hyper-V virtualized isolated environment. Windows Insiders will be the first to try out these new experience as we roll them out. Here is a recent RSA talk on Window Defender Application Guard if you'd like to understand this feature in some more detail. Below are some steps you can take to enable these cutting edge experiences on the latest Windows Insider Preview build.

How to setup and configure your system for Windows Defender Application Guard

Requirements:

• Windows 10 Enterprise SKU only, Build 16188+
• en-us only for the current builds; Full locale support will arrive soon
• PC must support Hyper-V (some older PCs may not support Hyper-V or have this feature disabled in BIOS)
• Windows Defender Application Guard is Off by default, it must be enabled manually or by policy

You can turn on Windows Defender Application Guard using the Turn Windows features on or off dialog. Select the checkbox as shown below for Windows Defender Application Guard.

Click OK and then restart your computer. 

How to Use Windows Defender Application Guard

1. Open Edge and click on the menu in the top right corner
2. Click on "New Application Guard window" as shown below
   
   Windows Defender Application Guard

3. You will see the following splash screen after which a new instance of Edge will open with Windows Defender Application Guard enabled.
   
   

    

4.  The new instance of Edge will open with Windows Defender Application Guard enabled
   
   

   
5. We encourage Windows Insiders to use Windows Defender Application Guard with Microsoft Edge to browse the Web. Your feedback, suggestions, and telemetry will help us to improve this feature.

Feedback Hub link: Launch Windows Feedback for Microsoft Edge\Application Guard

FAQ

1. Why don't I see my Favorites in the Application Guard Edge session?
   To keep your Application Guard Edge session secure and isolated from the host PC, favorites from the Application Guard Edge session are not copied back to your host PC.  Creating and persisting new Favorites within Application Guard Edge Session is coming in a future build.
   
   
2. Why do Cookies and Credentials seem to behave differently in the Application Guard Edge session? 
   Persisting of cookies and site credentials across Application Guard Edge sessions (i.e. host PC reboot or log-on) is coming in a future build.  These artifacts will always be isolated from the host PC.
   
   
3. Can I copy and paste between the host PC and Application Guard Edge session?
   Yes, the user can copy/paste Bitmap images/text to and from the Application Guard Edge session.
4. Why don't I see my Extensions in the Application Guard Edge session?
   The current version of Edge in Application Guard will not support Extensions, we are closely monitoring user feedback on this topic.
5. Can I download documents from the Application Guard Edge session onto my host PC?While it is not possible currently to download files from the isolated Application Guard container to the host PC, you do have the option of using "Print as PDF" or "Print as XPS" and save those files to the host PC.

Known Issues

1. In Build 16193 Windows Defender Application Guard will fail to work on touch PC's, showing a solid black window on launch. Non-touch enabled devices should not experience the issue. A temporary workaround if you would like to use WDAG is to go to Device Manager, expand Human Interface Devices and disable the "HID-compliant touch screen" and "Intel Precise Touch Device" if they are present. After a reboot try WDAG again. Re-enable these devices to restore touch.

[#2]

Build 17115 -  I have installed it but it doesn't display the button on EDGE. I noticed that I didn't have hyper v but I installed it and restarted and still no WDAG.

What's wrong ?

[#3]

Hello, 

Now RS 4 will be released in the near future. WDAG will then be available for Windows Pro. Why I can not use it under Windows 10 EDU which is a branch of Windows Enterprise? I am using 17133 on a Surface device and activated it with Windows PowerShell but there is no new menu in Edge. Hyper-V is activate too. 

Would be nice if some official Microsoft employee could answer here is this community.  

[#4]

Same here running rs4 1803 hyper-v enabled WDAG enabled through PowerShell no WDAG option in edge

[#5]

Hello,

Has anyone experienced this?  Running Windows 10 Enterprise 1803. After enabling Application Guard, regular Edge breaks.  Opens then closes. Unable to resolve this issue.

https://techcommunity.microsoft.com/t5/Windows-10-security/Microsoft-Edge-Opens-and-then-Closes-afte...

[#6]

Same issue for me, I am still researching. Would be good if you indicated if you had a resolution.

[#7]

Nope. Even worked with Microsoft Support.  Could not determine the issue. So I had to refresh again and not enroll the device.

[#8]

Sorry, I forgot to post back, however I have found the solution for this issue.  The same issue occurs when applying a software restriction policy.  And found this great article - 

https://sekharpadikkal.wordpress.com/2018/01/05/fix-for-the-microsoft-edge-crash-with-software-restr...

This is the solution:

1. Get-AppXPackage -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register “$($_.InstallLocation)\AppXManifest.xml” -Verbose}

2. reg add “HKCU\Software\Microsoft\Internet Explorer\Spartan” /v RAC_LaunchFlags /t REG_DWORD /d 1 /f

No reboot required.

[#9]

Hey just in case you never fixed this issue, you should be able to flash this bios one way or the other. get in touch with me if no one has helped you

---

@Tammy Pierce wrote:

I had Windows 10 Home Edition on my new computer purchased 12/2016 for my new business just started and his was a computer just to tie me over. It was destroyed this Memorial Day weekend by a hacker who used "the Microsoft's Industry leading Hyper-V virtualization technology" as MX puts it. It was put on my computer(how I don't know since I read it is incompadible with my edition). But I had at any one time 25 users using my computer as a host.They put a password on my BIOS and UEFI so I could not redo the BIOS or reinstall anything. I found a fill and printed a 17 page direction list of how they broke in and everything step by step to compromise and reder my computer helpless eventually after I dscovered all of these Hyper-V files. I am not a developer, I'm a soap maker, and it has taken me a long time to track this all down, but when I get developer emails for the Microsoft Insider roll out programs I know that that is were this person is coming from. I am in a program for the disabled to go back to work and destroying that computer has really set me back. Why and how can they install thing on your computer if your directions say that you can't and why is all of this in the hands of hackers!I'm just starting our and the money I spent on that computer is now gone and they have and probably are still stealling our internet, and no one is responsible or can stop them. How can Microsoft keep putting out all of this software to make it so easy for hackers to steal and ruin peoples lives and their businesses? attatched is a picture represnting what is on the computer in the home office it to is running a windows home edt Thank you for your time.

---

[#10]

I have deployed WDAG in standalone mode but one website always tries to open in AG Window. How do I prevent this website from opening in AG mode.