Creating a new Base Policy with the Wizard

When creating policies for use with App Control for Business, it's recommended to start with a template policy, and then add or remove rules to suit your App Control scenario. For this reason, the App Control Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about App Control can be accessed through the App Control design guide. This page outlines the steps to create a new App Control policy from a template, configure the policy options, and the signer and file rules.

Template Base Policies

Each of the template policies has a unique set of policy allowlist rules that affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy has a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility.

Italicized content denotes the changes in the current policy with respect to the policy prior.

More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the Example App Control for Business base policies article.

Once the base template is selected, give the policy a name and choose where to save the App Control policy on disk.

Configuring Policy Rules

Upon page launch, policy rules are automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule appears at the bottom of the page when the mouse hovers over the rule title.

Policy Rules Description

The following table has a description of each policy rule, beginning with the left-most column. The Policy rules article provides a fuller description of each policy rule.

Advanced Policy Rules Description

Selecting the + Advanced Options label shows another column of policy rules, advanced policy rules. The following table provides a description of each advanced policy rule.

Creating custom file rules

File rules in an App Control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the App Control policy. Selecting + Custom Rules opens the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules:

Publisher Rules

The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the reference file, is selected, use the slider to indicate the specificity of the rule. The following table shows the relationship between the slider placement, the corresponding App Control for Business rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule.

Filepath Rules

Filepath rules don't provide the same security guarantees that explicit signer rules do, as they're based on mutable access permissions. To create a filepath rule, select the file using the Browse button.

File Attribute Rules

The Wizard supports the creation of file name rules based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The following table describes each of the supported file attributes off which to create a rule.

File Hash Rules

Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product version's hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard uses file hash as the fallback in case a file rule can't be created using the specified file rule level.

Deleting Signing Rules

The policy signing rules list table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You're then prompted for another confirmation. Select Yes to remove the rule from the policy and the rules table.

Up next

• Editing an App Control for Business policy using the Wizard