Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1087074" data-attributes="member: 62850">BTW, the default factory policies includes the Microsoft Recommended Block rules.If anyone is having an issue with the Microsoft Recommended Block rules blocking an item, you will probably need to use the integrated WDAC Wizard and uncheck the Merge with Recommended User Mode Block Rules and uncheck the Merge with Recommended Kernel Block Rules.&nbsp; You should be able to do this with either the Policy Creator or Policy Editor options, and modifying the BasePolicies… both the Audit and Enforced.&nbsp; It is difficult to explain, but the modified WDAC Wizard should walk you right through the process.Better yet, you can use the Policy Editor to manually remove the specific rule, for both the Audit and Enforced BasePolicies.Or you could just put WDAC Lockdown into training mode for now.I am working on a feature that will automatically remove these Recommended Block Rules when the user clicks Allow.&nbsp; I meant to include this in the initial, but I completely forgot.&nbsp; It should be ready in a couple of days, possibly sooner.Edit:Also, there is a typo in the modified WDAC Wizard.&nbsp; The third line should read...The user modified policies are stored here: C:\ProgramData\DefenderUI\Policies</blockquote>

[QUOTE="danb, post: 1087074, member: 62850"] BTW, the default factory policies includes the Microsoft Recommended Block rules. If anyone is having an issue with the Microsoft Recommended Block rules blocking an item, you will probably need to use the integrated WDAC Wizard and uncheck the Merge with Recommended User Mode Block Rules and uncheck the Merge with Recommended Kernel Block Rules. You should be able to do this with either the Policy Creator or Policy Editor options, and modifying the BasePolicies… both the Audit and Enforced. It is difficult to explain, but the modified WDAC Wizard should walk you right through the process. Better yet, you can use the Policy Editor to manually remove the specific rule, for both the Audit and Enforced BasePolicies. Or you could just put WDAC Lockdown into training mode for now. I am working on a feature that will automatically remove these Recommended Block Rules when the user clicks Allow. I meant to include this in the initial, but I completely forgot. It should be ready in a couple of days, possibly sooner. Edit: Also, there is a typo in the modified WDAC Wizard. The third line should read... The user modified policies are stored here: C:\ProgramData\DefenderUI\Policies [/QUOTE]

Verification