Exploring Windows Defender Application Control
With its introduction in Windows 10, Windows Defender Application Control (WDAC) allows organizations to control the applications and drivers that are used in their environment. WDAC is implemented as part of the operating system and was also known under the name Device Guard.
It is recommended to use WDAC in combination with virtualization-based security (VBS). When used with VBS, WDAC’s security is enforced by hypervisor isolation, which makes it even harder for an adversary to circumvent your configured application control restrictions. While VBS is technically not required for WDAC, it can significantly enhance your overall system security and should always be enabled if possible.
In comparison to AppLocker rules, WDAC rules are deployed to the whole machine and affect every user logging on to this machine. But WDAC also offers more features and is considered more secure than AppLocker. Its principle is to trust nothing...
