Windows Defender App Control (WDAC) and Papercut

[petben]

Hello, has anyone created an ALLOW rule for the Papercut client in Windows Defender App Control? In the old days we exported the GPO .xml and imported that to Intune, but with no GPO we should all be using Windows Defender App Control apparently. 

 

When I browse to pc-client.exe in the WDAC tool to get the publisher it errors as below, this is apparently because the papercut files are not encrypted in a way WDAC can use:

pc‑client.exe is signed with an ECC (Elliptic Curve) certificate using SHA‑384.

 

Has anyone been able to add papercut to an allow rule in App Control?

 

Thanks

[NicholasEsping]

Do you use managed installers? You might be able to just deploy the papercut client using Intune as long as the Intune management extension is set as a managed installer the WDAC policy should allow the application to run. I use WDAC on my student devices but do not currently have papercut.  I was able to deploy MyQ which is a different print management solution with this method.

Edited May 8 by NicholasEsping

[petben]

Can you please suggest anything you did to allow 'managed installers' to be trusted. 

 

I am using WDAC Wizard and have the 'Managed Installer' slider enabled, but AI kind of says that's not enough. I have tried allowing another supplemental for msiexec which I am not sure is helping, and winget is still being blocked.

 

what else did you do?

Thanks

[NicholasEsping]

1 hour ago, petben said:

Can you please suggest anything you did to allow 'managed installers' to be trusted. 

 

I am using WDAC Wizard and have the 'Managed Installer' slider enabled, but AI kind of says that's not enough. I have tried allowing another supplemental for msiexec which I am not sure is helping, and winget is still being blocked.

 

what else did you do?

Thanks

Once you have the managed installer option set in your WDAC policy you can enable the Managed installer in a couple of different ways. There is an option in Endpoint security that will set the Intune Management extension as a managed installer. Otherwise, you can create your own AppLocker xml that can have additional managed installers. For example, I made our web filter a managed installer, so it is able to update everything without any issues. I then deploy this policy using proactive remediations. Here is the Microsoft documentation on creating managed installers and a GitHub page with example detection and remediation scripts.

Allow apps deployed with an App Control managed installer | Microsoft Learn
scripts/remediation.ps1 at main · ne8801/scripts · GitHub

[petben]

Thanks for the reply, do you know if winget deployed software (via Intune) will run OK?

[NicholasEsping]

1 minute ago, petben said:

Thanks for the reply, do you know if winget deployed software (via Intune) will run OK?

Yes, it should since Winget will be launched by the Intune management extension when deployed with Intune. If it's an app that auto updates you might run into issues when it updates if the updater is not a managed installer. If you control all updates through Intune, you should be fine.

[petben]

thanks, last thing, did you select the 2 x 'Merge with recommended...' settings? I initially did, then got loads of errors so I turned them off. I am thinking with that trusted installer policy it will be now be OK to enable.

 

Thanks for ur advice.

 

[NicholasEsping]

Yes, I do Merge with the recommended block rules. Here are the options I have set in my policy. I used to have Dynamic Code Security on, but it started causing problems with our web filter functionality.

[petben]

Ha, last thing (!)..sorry.

 

The policies now work We are finding ALL Store apps are running, I assume this is honouring the allow 'Microsoft Store Applications' bit in my base policy (below), but we really want to block all apps apart from some we specify. Have you editid your base policy (I was hoping to find something obvious like <Setting Value="Enabled:Allow Microsoft Store Apps" />, but there's not) or you done something else?

 

 

Thanks

[NicholasEsping]

9 minutes ago, petben said:

Ha, last thing (!)..sorry.

 

The policies now work We are finding ALL Store apps are running, I assume this is honouring the allow 'Microsoft Store Applications' bit in my base policy (below), but we really want to block all apps apart from some we specify. Have you editid your base policy (I was hoping to find something obvious like <Setting Value="Enabled:Allow Microsoft Store Apps" />, but there's not) or you done something else?

 

 

Thanks

For store apps I just use an AppLocker policy to block/allow the ones we want students using. I ran into that same issue with my policy and found it a lot easier to just use AppLocker then try to block/allow them in the base policy.

[petben]

thanks, could you please send a copy of the applocker 'block store apps' .xml, just so I can see the idea.

 

 

[NicholasEsping]

6 minutes ago, petben said:

thanks, could you please send a copy of the applocker 'block store apps' .xml, just so I can see the idea.

 

 

Here is my appx xml. I use the local group policy editor to create this on a test computer and then export the xml to push out with Intune.

<AppLockerPolicy Version="1">
  <RuleCollection Type="Appx" EnforcementMode="Enabled">
    <FilePublisherRule Id="0a45d15c-5033-48fa-88c1-d1d2d875b511" Name="AdobeSystemsIncorporated.AdobeReader, version 0.0.0.0 and above, from CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" ProductName="AdobeSystemsIncorporated.AdobeReader" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="28ee9e16-1d2a-470f-be7a-7449242ce033" Name="Signed by 3CX Software DMCC" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=FB532F09-9100-4C71-89EC-9FE6CFC37A83" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="3a25d9df-87fd-4538-a24c-e33e61f61bf0" Name="PearsonEducationInc.TestNav, version 0.0.0.0 and above, from Pearson Education Inc" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=064058AF-B77F-42B8-82D3-37A4EFB14996" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="3d68107b-186e-45c3-b875-79b370d05d82" Name="McGraw-HillEducation.McGraw-HillK-12ConnectEDMobil, version 0.0.0.0 and above, from CN=40CD84DB-C8D5-4A33-9354-6243F1A9EDA6" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=40CD84DB-C8D5-4A33-9354-6243F1A9EDA6" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="5b24053c-4f9c-4358-a308-e49f9ff3d165" Name="AdobePhotoshopExpress" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" ProductName="AdobeSystemsIncorporated.AdobePhotoshopExpress" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="721f1150-1e95-4c94-afae-480a8cc28b69" Name="Signed by INTEL CORP" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="75c4e5fd-44ae-4e0a-9fd4-a0d18e569ea2" Name="Duolingo" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=FFBE6978-4D2C-4598-A465-8F4DB11260AC" ProductName="D5EA27B7.Duolingo-LearnLanguagesforFree" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="7ff9438e-e9e8-4989-83dc-f55afa7c6d94" Name="Signed by Data Recognition Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=B603712B-3BB5-48D0-8DD4-5EF501685EFC" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="828c8b94-c536-4fe5-a9f0-661985bbff2a" Name="Signed by HP Inc." Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=ED346674-0FA1-4272-85CE-3187C9C86E26" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="8738e104-5a12-41d3-a711-0993b319232b" Name="Signed by Microsoft Corp." Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=33F0F141-36F3-4EC2-A77D-51B53D0BA0E4" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="94acd254-3656-4e27-82c7-2398a515c393" Name="Signed by Apple Inc." Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=5BD5593D-A41B-4F89-884E-B4F3E0FBAA75" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="bbafb65c-20f2-49a5-b5fe-fa6810b28848" Name="Signed by Notepad++" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=&quot;Notepad++&quot;, O=&quot;Notepad++&quot;, L=Saint Cloud, S=Ile-de-France, C=FR" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="bfc529c0-8dce-43ee-add0-ae6dd3d3985f" Name="Signed by Realtek Semiconductor Corp" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=83564403-0B26-46B8-9D84-040F43691D31" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c96e4c83-1eb2-46ab-82b6-261db96d44c8" Name="All signed packaged apps-Microsoft Corporation" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="ddb44d11-2ce1-431a-96a6-ebded18f935e" Name="All signed packaged apps-Microsoft Windows" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="e8947f11-2d60-47f0-a998-2b6130f33cfb" Name="Signed by Pearson Education Inc" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="CN=064058AF-B77F-42B8-82D3-37A4EFB14996" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
  </RuleCollection>
</AppLockerPolicy>

 

[petben]

thanks for all the help. I am surprised you are not using WDAC Supplemental polices to allow all those Publisher rules? 

[NicholasEsping]

3 hours ago, petben said:

thanks for all the help. I am surprised you are not using WDAC Supplemental polices to allow all those Publisher rules? 

That would probably be the better way to do this, and I really should switch it. Since we already needed to deploy AppLocker to make the Managed Installers work I just left it in the AppLocker policy.