WDAC - InTune Error after merging policies

Question

question

DaveB-0831 asked May 5, '22 LuDaiMSFT-0289 commented May 10, '22

WDAC - InTune Error after merging policies

If I create a test policy with a number of rules it seems to work ok

However after removing some rules with the WDAC wizard, it creates a new policy which 'errors' after deploying via InTune.
The only issue I can see is the ID_ALLOW fields no longer start at 1

Is this a glitch in the software?
It becomes really problematic when merging policies with multiple rules as I want to remove rules that aren't required.

mem-intune-device-configurations

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-05-06T03:40:41.387Z

LuDaiMSFT-0289 answered May 6, '22 DaveB-0831 commented May 9, '22

@DaveB-0831 Thanks for posting in our Q&A.

To clarify this issue, we appreciate your help to collect some information:
1.Did you deploy the new WDAC policy following this official article?
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune
Get the new xml file only has these two rules and convert the policy XML to binary format.
2. Is the target device Windows 10 1903+?
3.If possible, please check if there is any detailed error information about this policy in Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin.

If there is anything update, feel free to let us know.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DaveB-0831 · May 07 at 08:57 PM

Please see my other comment for the answers to your question.
The policies have been merging fine but after the 4th merge I'm getting this error in DeviceManagement-Enterprise-Diagnostic-Provider > Admin

MDM ConfigurationManager: Command failure status. Configuration Source ID: (474ADBF5-E567-4EBE-ADF5-8F7DC6ECA799), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (ApplicationControl), Command Type: (SetValue: from Replace), CSP URI: (./Vendor/MSFT/ApplicationControl/Policies/E89E0DE6-A7C7-4BE4-9E7A-57FD8CD4AC86/Policy), Result: (Your organization used Device Guard to block this app. Contact your support person for more info.).

Seems like something is blocking the policy?

0 ·

LuDaiMSFT-0289 DaveB-0831 · May 09 at 04:26 AM

@DaveB-0831 Sorry for the delay response because of this weekend off day.

Honestly, I haven't met this situation and there is no helpful information I can share with you. For this error message, it is not enough to confirm the root cause, so it is needed to check more background information based on your environment. With Q&A limitation resources, Q&A is not the good channel for such log analysis issue. It is suggested to create an online support ticket to get more accurate help. Here is the support link:
https://docs.microsoft.com/en-us/mem/get-support

Thanks for your understanding and hope everything goes well with you.

0 ·

DaveB-0831 LuDaiMSFT-0289 · May 09 at 07:49 AM

It's ok. I've managed to resolve it (see my marked answer).
Might be worth feeding this back though as it seems to be a bug between WDAC and InTune.

0 ·

Answer 2 · 2022-05-06T08:52:03.567Z

DaveB-0831 answered May 6, '22 DaveB-0831 edited May 8, '22

Hi,
Thanks for replying. Upon further investigation it's not deleting rules that breaks the policy, it's merging them.
Steps to reproduce:

I have a working policy deployed using https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune. My test machine has accepted the policy and it's working correctly.

I create a policy from the event viewer using https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies
I've left the default variables for testing. It creates the eventspolicy.xml on my desktop with the correct hash/publisher rules.

![199488-image.png][1]

I merge the policy with the original working base policy using either the WDAC wizard OR Merge-CIPolicy -PolicyPaths OptimiseBaseAUDIT_v3W.xml,EventsPolicy.xml -OutputFilePath MergedTest.xml. I can confirm MergedTest.xml has the correct policy ID as the base.

I create a .bin file using the MergedTest.xml file and deployed via InTune and it worked. I was also able to succesfully repeat the merging process 3 times (the base policy is getting larger).

After the 4th merge I'm getting an error in InTune

![199469-image.png][2]

The error under DeviceManagement-Enterprise-Diagnostic-Provider > Admin is:

MDM ConfigurationManager: Command failure status. Configuration Source ID: (474ADBF5-E567-4EBE-ADF5-8F7DC6ECA799), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (ApplicationControl), Command Type: (SetValue: from Replace), CSP URI: (./Vendor/MSFT/ApplicationControl/Policies/E89E0DE6-A7C7-4BE4-9E7A-57FD8CD4AC86/Policy), Result: (Your organization used Device Guard to block this app. Contact your support person for more info.).

image.png (14.0 KiB)

image.png (7.4 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2022-05-09T07:49:05.12Z

DaveB-0831 answered May 9, '22 LuDaiMSFT-0289 commented May 10, '22

If anyone else is having an issue deploying a WDAC policy in InTune after several merges, the only fix I've found is to reset the version number and ID. This will assign a new ID to the .xml file.

$PolicyName= "Lamna_FullyManagedClients_Audit"
$LamnaPolicy=$env:userprofile+"\Desktop\"+$PolicyName+".xml"
$MEMCMPolicy=$env:windir+"\CCM\DeviceGuard\MergedPolicy_Audit_ISG.xml"
Set-CIPolicyIdInfo -FilePath $LamnaPolicy -PolicyName $PolicyName -ResetPolicyID
Set-CIPolicyVersion -FilePath $LamnaPolicy -Version "1.0.0.0"

Make sure to update the policy ID in the InTune policy itself before deployment also.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LuDaiMSFT-0289 · May 10 at 01:08 AM

@DaveB-0831 Thanks for your kindness to feedback this fix about this issue. It is helpful for someone else who has the similar issue easily find the direction.

Thanks again and have a nice day. : )

0 ·

question