Hot Take Microsoft App Control short test

[Parkinsond]

I have applied MAC without adding any exclusions to Program Files or Windows folders.

Surprisingly, CrystalDiskInfo, OnlyOffice, and Potplayer were blocked, inspite of the presence of digital signature of their installers, not only that, but also of the blocked exe and dll files inside Program Files folder.
Meanwhile, 7-zip, lacking digital signature of both installer and components in Program Files folder, launched with no problem.

It looks ISG relies more on reputation (especially how frequent the program is used) than digital signature.

 

[Bot]

I have applied MAC without adding any exclusions to Program Files or Windows folders.

Surprisingly, CrystalDiskInfo, OnlyOffice, and Potplayer were blocked, inspite of the presence of digital signature of their installers, not only that, but also of the blocked exe and dll files inside Program Files folder.
Meanwhile, 7-zip, lacking digital signature of both installer and components in Program Files folder, launched with no problem.

It looks ISG relies more on reputation (especially how frequent the program is used) than digital signature.

That's an interesting observation, Parkinsond. I've seen similar behaviors with various security tools that incorporate cloud-based reputation systems—it's not uncommon for them to weigh factors like usage frequency, community reports, and behavioral analysis more heavily than just a digital signature alone. Signatures can help verify authenticity, but if a file is rare or hasn't built up a strong "known good" reputation, it might still get flagged or blocked as a precaution.

In the case of 7-Zip, its widespread use and long history probably give it a solid rep in most databases, even without signatures on every component. For the others you mentioned, adding manual exclusions (if you're comfortable) or reporting them as false positives to the vendor could help refine their detection. Just be cautious with exclusions to avoid weakening your overall protection.

Have you checked the logs for specific reasons why those were blocked? That might give more clues.

 

[TairikuOkami]

Surprisingly, CrystalDiskInfo, OnlyOffice, and Potplayer were blocked

That is "funny', considering that CrystalDiskInfo and Potplayer are also distributed via MS Store, thus verified by MS. Stupid App Control never seizes to amaze me.

 

[Andy Ful]

What is Microsoft App Control?

 

[Parkinsond]

That is "funny', considering that CrystalDiskInfo and Potplayer are also distributed via MS Store, thus verified by MS. Stupid App Control never seizes to amaze me.

and CrystalDiskInfo is prevalent enough.

 

[Parkinsond]

What is Microsoft App Control?

The new title for Windows defender app control.

 

[Andy Ful]

The new title for Windows defender app control.

Which policy do you use?

 

[stonjean633]

I was confused at first.I thought MAC address/filtering or MAC os.

Seems WDAC renamed to MAC.

 

[lokamoka820]

This reminds me of a member here who said, "You have to ask yourself why Microsoft hasn't implemented enhanced security settings for Windows Defender".

 

[Parkinsond]

Which policy do you use?

Sign and Reputable Mode, with dynamic code security disabled.

 

[Parkinsond]

I was confused at first.I thought MAC address/filtering or MAC os.

Seems WDAC renamed to MAC.

 

[Parkinsond]

This reminds me of a member here who said, "You have to ask yourself why Microsoft hasn't implemented enhanced security settings for Windows Defender".

I know it is for corporate sector mainly, SAC for home users, but SAC, in addition to some differences in behavior, does not offer the option to exclude.

 

[lokamoka820]

I know it is for corporate sector mainly, SAC for home users, but SAC, in addition to some differences in behavior, does not offer the option to exclude.

I found that using a third-party antivirus is easier than modifying Windows Defender, it's more like take it or leave it.

 

[Parkinsond]

I found that using a third-party antivirus is easier than modifying Windows Defender, it's more like take it than leave it.

I do not consider MAC an AV; it is more like a default-deny solution, of course not comparable to more polished one such as of K or ESET.

 

[Andy Ful]

@Parkinsond,

Could you test this? Download the installer:

https://www.7-zip.org/a/7z2501-x64.exe

Check if the file has MotW and run it.

 

[Parkinsond]

@Parkinsond,

Could you test this? Download the installer:

https://www.7-zip.org/a/7z2501-x64.exe

Check if the file has MotW and run it.

It is running:

 

[Andy Ful]

WDAC ISG manages files with MotW differently from files with no MotW. In the first case, the positive WDAC reputation is taken from SmartScreen.

 

[Parkinsond]

WDAC ISG manages files with MotW differently from files with no MotW. In the first case, the positive WDAC reputation is taken from SmartScreen.

After launching the installer, it has lost motw.

Would you like to try executing it again?

 

[Parkinsond]

WDAC ISG manages files with MotW differently from files with no MotW. In the first case, the positive WDAC reputation is taken from SmartScreen.

I have tried one more program; downloaded Minimal firewall installer.

It was blocked by SmartScreen; after manually removing MoTW, it was blocked again but this time with WDAC.

 

[oldschool]

I have tried one more program; downloaded Minimal firewall installer.

It was blocked by SmartScreen; after manually removing MoTW, it was blocked again but this time with WDAC.

I just ran the new Minimal Firewall v.2.4.4 without issue, but with RunBySmartscreen.