Skip to content
WindowsHardening

Area 05 / 12

Application Control

Allowlisting is the single most effective control against commodity malware and hands-on-keyboard tooling alike. This area compares App Control for Business (formerly WDAC) and AppLocker, shows how to start from Microsoft's example policies, run in audit mode, read Code Integrity events and move to enforcement without breaking line-of-business apps.

Start the path

Learning path

0/4 done
  1. 01App Control for Business (WDAC) vs AppLockerChoose between App Control for Business (formerly WDAC) and AppLocker, start from Microsoft's example policies, audit, read Code Integrity events and enforce without breaking apps.
  2. 02App Control managed installer, ISG and supplemental policiesKeep App Control for Business maintainable: trust Intune or ConfigMgr as a managed installer, use ISG carefully and delegate with supplemental policies.
  3. 03Microsoft vulnerable driver blocklist: stop BYOVDEnable and verify the Microsoft vulnerable driver blocklist on clients and servers, keep it current and detect bring-your-own-vulnerable-driver attacks.
  4. 04AppLocker rollout: scripts, installers and packaged appsRoll out AppLocker safely: Application Identity service, audit mode, publisher rules for EXE, script, MSI and packaged apps, and writable-folder gaps.