NET assemblies otherwise permitted by policy that cease to retain their signature upon being converted into a native image. The CodeIntegrity event log no longer appears to be polluted with NGEN events - i.e.The policy described below was built and deployed on a Windows 10 Professional host. Previously, one needed Window 10 Enterprise or Education to configure and build WDAC policies. There are no longer SKU licensing restrictions when building WDAC policies.Latest Improvements to WDAC in 20H2īefore diving into the weeds, I wanted to highlight the improvements to WDAC in 20H2 that I observed. My hope is to help supply further evidence that WDAC is worthy of your consideration if mitigating and detecting large classes of attack techniques is a priority for you and/or if you’re a parent wanting to squeeze as much shelf life out of a Windows computer for your kids. The goal of this post is to highlight some of the awesome WDAC improvements made since the release of Windows 10 20H2 in the context of building and applying a relatively simple but very secure policy to a single system. Along with traditional least-privilege principles in place, WDAC, with a proper policy in place should serve as an ideal, built-in solution to both help protect her from external threats but to also mitigate self-inflicted destruction. 1 Laptop as my young daughter’s first Windows-based computer for play and experimentation.Īs a security practitioner, obviously, I want to protect her from external threats as much a possible but as a dad who is acutely aware and in awe of a child’s willingness to experiment, I acknowledge that my daughter will do everything in her power to corrupt (intentionally or otherwise) her Windows installation. Until recently, I had gotten away from configuring Windows Defender Application Control (WDAC) until the lead-up to Christmas when I wanted to repurpose an older Microsoft Surface Gen. Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy

Windows defender application control