BIN Errors about windows-defender-application-control-hardening HOT 7 CLOSED

XML vs. BIN:

Simply put, the "XML" policies are for applying to a machine locally and the "BIN" files are for enforcing them with either [Group Policy](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy) or [Microsoft Intune](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune).

https://github.com/simeononsecurity/Windows-Defender-Application-Control-Hardening#xml-vs-bin

Thanks for the wonderful documentation! The BIN files are generated from the XML files using the WDAC Toolkit released by Microsoft. As far as I'm aware you can't apply the BIN files locally using the command line. They must be pushed from GPO or from Intune.

from windows-defender-application-control-hardening.

I couldn't make the converted *.bin versions work (I ran the conversion script included), so I edited those on WDAC (to generate the *.cip policies), and followed this, then bricked my workstation since I selected the enforced version by accident, any tips for reverting? (already tried running the audit version, hoping that it would override the newly set policies but no dice)

from windows-defender-application-control-hardening.

Terribly sorry you bricked your system. Can you explain more about what isn't working?
This is what the audit only rules are for. So you can test them.

from windows-defender-application-control-hardening.

We've made a few changes and updated the policies slightly. Also we started including CIP versions as well.
Please review the changes as well as all the Recommended Reading
https://github.com/simeononsecurity/Windows-Defender-Application-Control-Hardening

from windows-defender-application-control-hardening.

Lastly,
Reversing the policies can be done multiple ways, however it can be difficult because it depends on the manner in which you implemented them.
You can read the following for some guidance
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies
https://stackoverflow.com/questions/68906446/wdac-policy-doesnt-disable
https://improsec.com/tech-blog/one-thousand-and-one-application-blocks

from windows-defender-application-control-hardening.

@Gildedter
For your convince, we've also update the repo to include a custom view for event viewer for streamlined troubleshooting.
https://github.com/simeononsecurity/Windows-Defender-Application-Control-Hardening/tree/main/Files/CUSTOM%20EVENT%20VIEW

from windows-defender-application-control-hardening.

No activity from @Gildedter after a week.

from windows-defender-application-control-hardening.