diff --git a/Wiki posts/AppControl Manager/Allow New Apps.md b/Wiki posts/AppControl Manager/Allow New Apps.md index 8b8364af5..bef138d02 100644 --- a/Wiki posts/AppControl Manager/Allow New Apps.md +++ b/Wiki posts/AppControl Manager/Allow New Apps.md @@ -42,4 +42,6 @@ If something like a power outage occurs during the audit mode phase, on the next * **Scan Level**: You can choose from different scan levels. [Refer to this page for all the information about them.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide) +* **Browse for folders**: Use this button in Step 2 to browse for the installation directories of the app(s) you installed. This will help improve the accuracy of the supplemental policy that will be created. If for some reason you cannot locate the installation directory of the app you installed, ensure you start the app after installation, use it as you normally would so that audit logs will be generated for all of its files and components. These audit logs will then be displayed to you in the `Review the Event Logs` tab. +
diff --git a/Wiki posts/AppControl Manager/AppControl Manager.md b/Wiki posts/AppControl Manager/AppControl Manager.md index 561b7158f..00b44363b 100644 --- a/Wiki posts/AppControl Manager/AppControl Manager.md +++ b/Wiki posts/AppControl Manager/AppControl Manager.md @@ -107,9 +107,9 @@ AppControl Manager is engineered with a security-first approach from the ground * Any file(s) the AppControl Manager ever produces, uses or expects is only from an Administrator-protected location in `C:\Program Files\AppControl Manager`. -* The AppControl Manager supports [process mitigations / Exploit Protections](https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference) such as: `Blocking low integrity images`, `Blocking remote images`, `Blocking untrusted fonts`, `Disabling extension points`, `Export Address Filtering`, `Hardware enforced stack protection`, `Import Address Filtering`, `Validate handle usage`, `Validate stack integrity` and so on. +* The AppControl Manager supports [process mitigations / Exploit Protections](https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference) such as: `Blocking low integrity images`, `Blocking remote images`, `Blocking untrusted fonts`, `Strict Control Flow Guard`, `Disabling extension points`, `Export Address Filtering`, `Hardware enforced stack protection`, `Import Address Filtering`, `Validate handle usage`, `Validate stack integrity`. -* The AppControl Manager always uses the latest .NET and SDK versions, ensuring all the security patches released by Microsoft will be included. +* The AppControl Manager always uses the latest .NET SDK and NuGet package versions, ensuring all the security patches released by Microsoft will be included. * The entire codebase is thoroughly commented, allowing code reviewers to effortlessly examine and verify every aspect of AppControl Manager's source code. @@ -131,13 +131,13 @@ AppControl Manager is engineered with a security-first approach from the ground ### Where Are The Temporary Files Saved To? -The Temporary Files Are Stored in the Following Directory +The temporary files are stored in the following directory ``` C:\Program Files\AppControl Manager\StagingArea ``` -Each applicable feature of the AppControl Manager that you start using will generate a uniquely named subdirectory within the StagingArea to store its temporary files (if needed). Upon closing the application, the entire StagingArea directory, along with its contents, will be automatically deleted. These files are utilized by the application for tasks such as creating policies, storing temporary scan results, and other related functions. +Each applicable feature of the AppControl Manager that you start using will generate a uniquely named subdirectory within the `StagingArea` to store its temporary files (if needed). Upon closing the application, the entire StagingArea directory, along with its contents, will be automatically deleted. These files are utilized by the application for tasks such as creating policies, storing temporary scan results, and other related functions.
diff --git a/Wiki posts/AppControl Manager/Deploy App Control Policy.md b/Wiki posts/AppControl Manager/Deploy App Control Policy.md index f693c3bea..13ce2609e 100644 --- a/Wiki posts/AppControl Manager/Deploy App Control Policy.md +++ b/Wiki posts/AppControl Manager/Deploy App Control Policy.md @@ -10,21 +10,26 @@
-Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to select XML policy files or `.cip` binary files to deploy on the system. +Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to select XML policy files or `.cip` binary files to deploy on the local/cloud systems or convert XML files to CIP files for manual deployment.
-## Configuration Details for Unsigned Deployment +> [!IMPORTANT]\ +> **Intune Cloud Deployment** +> +> Please [**refer to this page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager) for details on how to upload App Control Policies to Intune using AppControl Manager. -* **Select XML Policy File(s)**: Use this button to browse for App Control XML policy files. +
+ +## Configuration Details for Unsigned XML Policy Files Deployment -* **Select CIP Binary File(s)**: Use this button to browse for App Control CIP binary files. +* **Browse**: Use this button to browse for App Control XML policy files that you want to deploy as unsigned policies. -* **Deploy**: Use this button to deploy all of the XML and CIP files you selected on the system. +* **Deploy**: Use this button to deploy all of the XML files you selected on the local or cloud system.
-## Configuration Details for Signed Deployment +## Configuration Details for Signed XML Policy Files Deployment
@@ -36,6 +41,14 @@ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Securit
+* **Browse**: Use this button to browse for App Control XML policy files that you want to Sign and deploy. + +* **Deploy**: Use this button to deploy all of the XML files you selected on the local or cloud system. + +* **Sign Only - No Deployment**: If you only want to sign the policy without deploying it, you can use this button. It will generate the signed CIP file for you that you can use to manually deploy somewhere else. + +
+ When signing and deploying App Control Policies, a dialog will be displayed asking for additional information required for signing the policy. * **Certificate File**: Provide the path to the certificate `.cer` file. It must be a code signing certificate that is either issued by a public certificate authority (CA) or a self-signed certificate. You can generate a self-signed certificate suitable for App Control policy signing in [the certificate building page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-New-Certificate) of the AppControl Manager. The certificate's details will be added to the XML policy as signers. The certificate must exist in the Personal store of the Current User certificate stores with private key. @@ -50,8 +63,22 @@ All of the information you submit will be saved in app settings so that the next
-## Intune Cloud Deployment +## Configuration Details for CIP Binary Files Deployment + +This section can deploy `.CIP` binary files on the local or cloud system, whether they are signed or unsigned. + +* **Browse**: Use this button to browse for App Control `CIP` binary files that you want to deploy. + +* **Deploy**: Use this button to deploy all of the CIP files you selected on the local or cloud system. + +
+ +## Configuration Details for Converting XML to CIP Files + +Use this section to convert all of your XML files to CIP binaries files in bulk. + +* **Browse**: Use this button to browse for App Control XML policy files that you want to convert to `CIP` binary files. -Please [**refer to this page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager) for details on how to upload App Control Policies to Intune using AppControl Manager. +* **Convert**: Use this button to convert all of the selected XML policy files to `CIP` binary files with the same file names.
diff --git a/Wiki posts/WDACConfig Module Main/WDACConfig.md b/Wiki posts/WDACConfig Module Main/WDACConfig.md deleted file mode 100644 index a8caaa69f..000000000 --- a/Wiki posts/WDACConfig Module Main/WDACConfig.md +++ /dev/null @@ -1,23 +0,0 @@ -# WDACConfig (Windows Defender Application Control) Module - -> [!IMPORTANT]\ -> This module is being deprecated. Use the new AppControl Manager application -> https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager -> - -## Preview of the App - -
- - AppControl Manager preview - -
- - AppControl Manager YouTube Video demo thumbnail - -
- -
- -horizontal super thin rainbow RGB line - -