WDAC not applying via Group Policy

[Diogo Sousa]

Hello and greetings from Portugal!

I'm trying to implement WDAC via group policy.

I've used WDAC Wizard and if I copy the *.cip file to "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" I see that WDAC get enabled, for example using the MSInfo32.

But, I cannot enable  WDAC via GPO. I've converted the *.xml to *.bin and enable the "Deploy Windows Defender Application Control".

I see the event id 7010 "Device Guard successfully processed the Group Policy: Configurable Code Integrity Policy = Enabled" but the thing is MSInfo still doesn't show that WDAC is activated.

Can someone please help?

[#2]

Hi,
What if you try with a single policy format (.p7b) file?

There is also the script method for deployment, a built-in tool in Windows 11 22H2 and above makes it very easy.
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-co...

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-co...

if it's a signed WDAC policy, it needs to be deployed with script:
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-co...

[#3]

Hi and thanks for the help!

I was using a deprecated way to do this via GPO. Instead of using the bin file, just need to copy the *.cip file to "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" :)

Best regards,
Diogo Sousa

[#4]

Glad you sorted it out :)

btw I created a bunch of wiki posts on Github regarding WDAC, signed WDAC etc., all referenced to Microsoft websites, feel free to check it out, learned a lot myself while making it

https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction