Windows 10 Allow WDAC application Control policy to allow Microsoft patches to run

[Alles Fernando]

Hello All,

I have created WDAC policy on Windows 10 enterprise. I created the WDAC policy in the following method:

I used the following files to merged and created the .BIN file


1. AllowMicrosoft.xml(default Microsoft example files that comes with he OS- to allow Microsoft program to run)

2.Program Files.xml(scanned the program Files for installed applications)

3.Program Filesx86.xml(scanned the program Filesx86 for installed applications)

4 BlockRules.xml(Microsoft recommended block rules for WDAC)

Merged the above 4 files and created the Mypolicy.xml and convertd to .bin files and copy to SIPolicy.p7b



However I can see Microsoft office patches(.MSP) downloaded from WSUs violated the code integrity.

I would like to know how to bypass the patch files in CI policy.I believe I cant scan the folder and merge with the existing policy as patch files would be different for different period?

one of the error msg :

code integriy module \windows\installer\MSI8448.tmp against policy

anybody can shed some light would be appreciated.



Thank you,



Regards,

Alles

Continue reading...