Skip to content

Latest commit

 

History

History
297 lines (222 loc) · 8.5 KB

Audit Write Access.md

File metadata and controls

297 lines (222 loc) · 8.5 KB
Raw

Device control policy sample: Audit Write Access

Description: This is a policy.
Device Type: None

A device control policy is a combination of policy rules, groups and settings.
This sample is based on the sample files.
To configure the sample, follow the deployment instructions.

Policy Rules

Name Devices Rule Type Access Notification Conditions
Included Excluded Disk Read Disk Write Disk Execute File Read File Write File Execute

Groups

Settings

Setting Name Setting Value Description Documentation
DefaultEnforcement Deny Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched. documentation
DeviceControlEnabled True Enables/disables device control documentation

Files

This policy is based on information in the following files:

Deployment Instructions

Device control policy rules and groups can be deployed through the following management tools:

Windows

Mac

Intune UX

Create a Device Control Rules configuration profile
  1. Navigate to Home > Endpoint Security > Attack Surface Reduction
  2. Click on "Create Policy"
  3. Under Platform, select "Windows 10 and later"
  4. Under Profile, select "Device Control Rules"
  5. Click "Create"
  6. Under Name, enter **
  7. Optionally, enter a description
  8. Click "Next"

Group Policy (GPO)

Define device control policy groups
  1. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Device Control > Define device control policy groups.
  2. Save the XML below to a network share.
<Groups>
</Groups>
  1. In the Define device control policy groups window, select Enabled and specify the network share file path containing the XML groups data.
Define device control policy rules
  1. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Device Control > Define device control policy rules.
  2. Save the XML below to a network share.
<PolicyRules>
</PolicyRules>
  1. In the Define device control policy rules window, select Enabled, and enter the network share file path containing the XML rules data.

Intune Custom Settings

Create custom intune configuration
  1. Navigate to Devices > Configuration profiles
  2. Click Create (New Policy)
  3. Select Platform "Windows 10 and Later"
  4. Select Profile "Templates"
  5. Select Template Name "Custom"
  6. Click "Create"
  7. Under Name, enter **
  8. Optionally, enter a description
  9. Click "Next"
Add a row for DefaultEnforcement

  1. Click "Add"

  2. For Name, enter DefaultEnforcement

  3. For Description, enter **

  4. For OMA-URI, enter ./Vendor/MSFT/Defender/Configuration/DefaultEnforcement

  5. For Data type, select Integer

  6. For Value, enter 2

  7. Click "Save"

Add a row for DeviceControlEnabled

  1. Click "Add"

  2. For Name, enter DeviceControlEnabled

  3. For Description, enter **

  4. For OMA-URI, enter ./Vendor/MSFT/Defender/Configuration/DeviceControlEnabled

  5. For Data type, select Integer

  6. For Value, enter 1

  7. Click "Save"

Mac Policy

Mac Deployment with Intune

  1. Create the .mobileconfig file
Copy the contents below into a file, and save it. 
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadIdentifier</key>
        <string>com.microsoft.wdav</string>
        <key>PayloadDisplayName</key>
        <string>Microsoft Defender settings</string>
        <key>PayloadDescription</key>
        <string>Microsoft Defender configuration settings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadRemovalDisallowed</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadType</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadOrganization</key>
                <string>Microsoft</string>
                <key>PayloadIdentifier</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadDisplayName</key>
                <string>Microsoft Defender configuration settings</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>dlp</key>
                <dict>
                  <key>features</key>
                    <array>
                        <dict>
                            <key>name</key>
                            <string>DC_in_dlp</string>
                            <key>state</key>
                            <string>enabled</string>
                        </dict>
                    </array>
                </dict>
                <key>deviceControl</key>
                <dict>
                    <key>policy</key>
                    <string>
{
    "groups": [],
    "rules": [],
    "settings": {
        "global": {
            "defaultEnforcement": "deny"
        }
    }
}
                    </string>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

  1. Deploy the .mobileconfig file using Intune

    1. Navigate to https://endpoint.microsoft.com/ > Devices > macOS > ** Configuration profiles
    2. Click on create + New Policy
    3. Select Profile type Templates
    4. Select Custom profile
    5. Enter the name of the policy, optionally a description, and then click Next
    6. Select the device deployment channel
    7. Choose the .mobileconfig that you created
    8. Click "Next"
    9. Scope, assign and deploy the policy.

Manual Mac Deployment

  1. Create the .json file
Save the .json to a file 
{
    "groups": [],
    "rules": [],
    "settings": {
        "global": {
            "defaultEnforcement": "deny"
        }
    }
}
  1. Use mdatp config device-control policy set --path <full-path-to-policy.json> to apply the policy.

Mac Deployment with JAMF

Instructions on how to deploy the policy with JAMF can be found here

Learn more