Skip to content

Commit f7e0db3

Browse files
HotCakeXHotCakeX
authored
Updated and adding new documents (#562)
Updated and added new documents for App Control and AppControl Manager app.
1 parent 54f6125 commit f7e0db3

7 files changed

+187
-1
lines changed

‎Rationale.md

+2
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,8 @@ Make sure to use Surface products that support [Device Firmware Configuration In
161161

162162
* Pluton security chip is included in [Qualcomm Snapdragon ARM CPUs](https://www.qualcomm.com/products/mobile/snapdragon/pcs-and-tablets/snapdragon-x-elite), [AMD](https://blogs.windows.com/windowsexperience/2024/04/16/amds-commercial-ai-pc-portfolio-integrates-microsoft-pluton-includes-microsoft-copilot/) and [Intel CPUs](https://www.theverge.com/2024/6/3/24169115/intel-lunar-lake-architecture-platform-feature-reveal).
163163

164+
* [Copilot+](https://www.microsoft.com/en-us/windows/copilot-plus-pcs) PCs are among [the most secure consumer grade devices](https://blogs.windows.com/windowsexperience/2024/09/27/update-on-recall-security-and-privacy-architecture/). They are secured-core and incorporate the Pluton security chip.
165+
164166
<br>
165167

166168
> [!IMPORTANT]\

‎Wiki posts/App Control for Business/How To Create an App Control Supplemental Policy.md

+51-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,57 @@ You can customize the XML file further using different pages and features of the
4444

4545
<br>
4646

47-
### FAQs
47+
## Create a Supplemental Policy for Packaged Apps
48+
49+
Packaged apps are modern, they use MSIX packages and are easy to manage and authorize in App Control policies because all of the files in a packaged app share the same signing certificate and Package Family Name.
50+
51+
Use the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create supplemental policies for packaged apps. The policy that you create will not need any changes when the apps are updated since the authorization is based on the `PackageFamilyName` aka `PFN`.
52+
53+
In the [**Create Supplemental Policy Page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Supplemental-App-Control-Policy), navigate to the **Package Family Name** section.
54+
55+
<br>
56+
57+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/fa77675ec8cea0f73303487b3875600393d2948e/Pictures/PNG%20and%20JPG/How%20To%20Create%20an%20App%20Control%20Supplemental%20Policy/PFN%20section.png" alt="Package Family Name section">
58+
59+
<br>
60+
61+
<br>
62+
63+
Select the installed apps from the list. The list is automatically populated when you first expand the **Package Family Name** section. If you installed or removed apps, you can use the **Refresh** button to update the list of apps. Use the search bar to easily find the app(s) you are looking for.
64+
65+
Next enter a name for the supplemental policy and browse for the base policy that this supplemental policy will be associated with.
66+
67+
<br>
68+
69+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/refs/heads/main/Pictures/PNG%20and%20JPG/How%20To%20Create%20an%20App%20Control%20Supplemental%20Policy/PFN%20package%20selection%20and%20base%20policy%20button.png" alt="PFN select base policy and packaged apps from the list">
70+
71+
<br>
72+
73+
<br>
74+
75+
Finally press the `Create Supplemental Policy` button to create the supplemental policy. If you toggle the **Deploy after Creation** button the policy will also be deployed on the system and you will be able to view it in the [System Information page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information).
76+
77+
<br>
78+
79+
## Create a Supplemental Policy That Allows an Entire Folder
80+
81+
You can create a supplemental policy that will allow everything inside of a folder to be authorized to run. It is based on wildcard file path. This type of supplemental policy is less secure than ones that are based on file signature, publisher or hash so use it with caution.
82+
83+
Navigate to the [**Create Supplemental Policy Page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Supplemental-App-Control-Policy) page in the AppControl Manager and select the **Files and Folders** section.
84+
85+
<br>
86+
87+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/f391b22dfba59f8070a9d7191c743827dc89afb3/Pictures/PNG%20and%20JPG/How%20To%20Create%20an%20App%20Control%20Supplemental%20Policy/wildcard%20folder%20path.png" alt="Creating wildcard based folder path supplemental policy">
88+
89+
<br>
90+
91+
<br>
92+
93+
Enter an appropriate policy name. Set the Scan Level to **WildCard Folder Path**, you will notice that the **Browse for Files** section is deactivated in this mode. Use the **Browse for Folders** button to select the folder you want to allow and finally press the **Create Supplemental Policy** button to create the policy. If you toggle the **Deploy after Creation** button, the policy will also be deployed on the system and you will be able to view it in the [System Information page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information).
94+
95+
<br>
96+
97+
## FAQs
4898

4999
Q: What happens if you create a supplemental policy with the same name as an existing one?
50100

‎Wiki posts/App Control for Business/How to Create an App Control Deny Policy.md

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# How to Create an App Control Deny Policy
2+
3+
Application Control is based on whitelisting strategy, that means everything that is not allowed in the policy is automatically denied. However, there are times when you might need to only prevent a certain app or file from running, while allowing everything else. This is where the App Control Deny Policy comes in.
4+
5+
Use the [Create Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Deny-App-Control-Policy) page in the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create a new App Control Deny Policy based on different criteria.
6+
7+
<br>
8+
9+
## Create an App Control Deny Policy by Scanning Files and Folders
10+
11+
In the [Create Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Deny-App-Control-Policy) page, select the **Files and Folders** section to expand it.
12+
13+
<br>
14+
15+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/ea0139c82415aa735341490086ff22af03d93a87/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/Files%20and%20Folders%20section.png" alt="Deny policy Files and Folders section">
16+
17+
<br>
18+
19+
<br>
20+
21+
* Browse for files and/or folders that you want to be scanned and included in the Deny policy.
22+
23+
* Select an appropriate name for the Deny policy that will help you recognize it after deployment.
24+
25+
* The scalability is set to ***2*** by default but you can increase it if the number of files/folders are too many. The higher this number, the faster the scan will be completed and the more system resources will be consumed during the scan phase.
26+
27+
<br>
28+
29+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/c89b6fd8edeaea7062fb7b73a00b593f13b16c62/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/Files%20and%20Folders%20details%20filled.png" alt="Files and Folders deny policy section">
30+
31+
<br>
32+
33+
<br>
34+
35+
Having selected all of the required details, you can now press the **Create Deny Policy button** and wait for the scan to finish.
36+
37+
All of the files and folders that you selected will be recursively scanned and any App Control compatible files that are found in them will be added to **View detected file details** page at the bottom of the section to show you the exact files that will be included in the deny policy.
38+
39+
<br>
40+
41+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/c89b6fd8edeaea7062fb7b73a00b593f13b16c62/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/Files%20and%20Folders%20Scan%20Results.png" alt="Files and Folders deny policy section scan results">
42+
43+
<br>
44+
45+
<br>
46+
47+
If you toggle the **Deploy after Creation** button the Deny policy will also be deployed on the system after creation.
48+
49+
<br>
50+
51+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/b716692bc5eac4158f07fb2f1a3f94fa2ecdf609/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/Files%20and%20Folders%20Deploy%20button.png" alt="Files and folders section Deploy button focus">
52+
53+
<br>
54+
55+
<br>
56+
57+
## Create a Deny Policy for Packaged Apps
58+
59+
Packaged apps are modern, they use MSIX packages and are easy to manage and block/deny in App Control policies because all of the files in a packaged app share the same signing certificate and Package Family Name.
60+
61+
Use the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create deny policies for packaged apps. The policy that you create will not need any changes when the apps are updated since the denial is based on the `PackageFamilyName` aka `PFN`.
62+
63+
In order to create this type of deny policy, navigate to the [Create Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Deny-App-Control-Policy) page in the AppControl Manager and expand the **Package Family Name** section.
64+
65+
<br>
66+
67+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/29c774a6339adf75bea5f019ad32a3f214fe764e/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/Deny%20policy%20PFN%20app%20selection.png" alt="PFN section selecting apps after search">
68+
69+
<br>
70+
71+
<br>
72+
73+
The apps list will be automatically preloaded for you upon expanding the section. You can use the search bar to search for one or more app(s) and then select them.
74+
75+
Next, enter a suitable name for the Deny policy and finally press the **Create Deny Policy** button.
76+
77+
The deny policy will be created and if you toggled the **Deploy after Creation** button, it will also be deployed on the system.
78+
79+
In the screenshots above, we searched for the Photos app, selected it and after deploying that policy, the Photos app will no longer be able to run on the system when we try to launch it.
80+
81+
<br>
82+
83+
<img src="https://raw.githubusercontent.com/HotCakeX/.github/ce3c1c2553573fcb16036ebee76989ab7dd8a403/Pictures/PNG%20and%20JPG/How%20to%20Create%20an%20App%20Control%20Deny%20Policy/example%20of%20blocked%20photos%20app%20for%20PFN%20section.png" alt="PFN blocked Photos app notice in Windows">
84+
85+
<br>
86+
87+
<br>

‎Wiki posts/App Control for Business/Introduction.md

+2
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ If a policy is not deployed in audit mode, it is considered to be in enforced mo
129129

130130
* [How To Create and Maintain Strict Kernel‐Mode App Control Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-and-Maintain-Strict-Kernel%E2%80%90Mode-App-Control-Policy)
131131

132+
* [How to Create an App Control Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-an-App-Control-Deny-Policy)
133+
132134
* [Fast and Automatic Microsoft Recommended Driver Block Rules updates](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates)
133135

134136
* [App Control Notes](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes)

‎Wiki posts/AppControl Manager/Create Deny Policy.md

+21
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@ All Deny policies have 2 allow all rules so that anything not denied by them wil
1818

1919
<br>
2020

21+
> [!IMPORTANT]\
22+
> [How to Create an App Control Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-an-App-Control-Deny-Policy)
23+
24+
<br>
25+
2126
## Create a Deny Policy by Files or Folders Scan
2227

2328
With AppControl Manager, you can easily create a Deny base policy by scanning files or folders.
@@ -38,3 +43,19 @@ With AppControl Manager, you can easily create a Deny base policy by scanning fi
3843
> Use the ***View Detected File Details*** section to view highly detailed results of the files and folder scans.
3944
4045
<br>
46+
47+
## Create a Deny Policy Based on Package Family Names
48+
49+
You can create Deny policies for the installed packaged apps. This is useful for only blocking specific apps that are installed on the system.
50+
51+
### Configuration Details
52+
53+
* **Policy Name**: Enter a name for the Deny policy.
54+
55+
* **Package Family Names**: In this section, you can view the list of all installed apps. Use the search bar to looking for a specific app and after finding them, click/tap on them to select them.
56+
57+
* Use the "Select All" and "Remove Selections" buttons to select/deselect all apps currently available in the list.
58+
59+
* Use the Refresh button to refresh the list of installed apps in case you removed/installed any apps after the list was loaded.
60+
61+
<br>

‎Wiki posts/AppControl Manager/Create Supplemental Policy.md

+23
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wik
1414

1515
<br>
1616

17+
> [!IMPORTANT]\
18+
> [How To Create an App Control Supplemental Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-an-App-Control-Supplemental-Policy)
19+
20+
<br>
21+
1722
## Create a Supplemental Policy by Files or Folders Scan
1823

1924
With AppControl Manager, you can easily create a supplemental policy by scanning files or folders. If an application or file is being blocked by Application Control, use this feature to scan its files or installation directory. This process enables you to generate a supplemental policy that ensures the application or file can run seamlessly on your system.
@@ -82,3 +87,21 @@ This supplemental policy can be created only for Kernel-mode files/drivers, typi
8287
* **Base Policy File**: Browse for the path to the base policy XML file that this Supplemental policy will be expanding.
8388

8489
<br>
90+
91+
## Create a Supplemental Policy Based on Package Family Names
92+
93+
You can create Supplemental policies for the installed packaged apps. These are modern apps packaged in MSIX files, such as the AppControl Manager itself, or many of the apps installed from the Microsoft Store.
94+
95+
### Configuration Details
96+
97+
* **Policy Name**: Enter a name for the Supplemental policy.
98+
99+
* **Base Policy File**: Browse for the path to the base policy XML file that this Supplemental policy will be expanding.
100+
101+
* **Package Family Names**: In this section, you can view the list of all installed apps. Use the search bar to looking for a specific app and after finding them, click/tap on them to select them.
102+
103+
* Use the "Select All" and "Remove Selections" buttons to select/deselect all apps currently available in the list.
104+
105+
* Use the Refresh button to refresh the list of installed apps in case you removed/installed any apps after the list was loaded.
106+
107+
<br>

‎Wiki posts/Home Index.md

+1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [Introduction](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction)
3939
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [How To Generate Audit Logs via App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Generate-Audit-Logs-via-App-Control-Policies)
4040
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [How To Create an App Control Supplemental Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-an-App-Control-Supplemental-Policy)
41+
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [How to Create an App Control Deny Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-an-App-Control-Deny-Policy)
4142
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [The Strength of Signed App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/The-Strength-of-Signed-App-Control-Policies)
4243
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [How To Upload App Control Policies To Intune Using AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager)
4344
- <img src="https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Gifs/wings/yellowwings.gif" width="35"> [How To Create and Maintain Strict Kernel‐Mode App Control Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-and-Maintain-Strict-Kernel%E2%80%90Mode-App-Control-Policy)

0 commit comments

Comments
 (0)