WDAC Winget Problem (Newbie Problem)

[iercer]

Hello,

I'm experiencing an issue when I try to deploy a new -Allownewapps WDACConfig xml file; I can't use the apps I got from winget. On the Harden-Windows-Security wiki, it says it advises utilising microsoft store or winget, but I can't use winget and the apps I downloaded from it. How can I address this problem? I also tried deploying the DefaultWindows.xml file, but it still does not work. I would be appreciated it if you could assist me. Thank you.

[HotCakeX]

Hi,
If you're new to WDAC i suggest practicing in a VM first and once you're confident enough then use it on your own system, if something goes wrong you can revert the VM using snapshot quickly.

You can remove all deployed policies using Remove-WDACConfig and then restart to regain full functionality.

I've included many documentations and will continue to add more. What you usually do is deploying a base policy first, and then use the -AllowNewApps parameter of the Edit-WDACConfig or Edit-SignedWDACConfig to deploy supplemental policies.

That parameter safely turns on audit mode in the system, allowing you to install apps/programs from anywhere including Winget, Store, Internet etc., at the end, it will let you pick folders where the apps where installed, or you can let it automatically detect the new files that were run during the audit mode, display them to you so you can verify them, and create and deploy a supplemental policy.

[iercer]

Thank's for the assist and is there a way to allow previously downloaded apps from winget I can't find in the document or do I need a fresh install

[HotCakeX]

Of course, you can use the same parameter to allow the already installed apps, you can browse for any installed app's directories or run the already installed apps so they will automatically be detected.

Those are unified commands that can be used for many purposes, so Edit-WDACConfig -AllowNewApps is your single go to command for majority of things when interacting with WDAC.

Alternatively, there is New-SupplementalWDACConfig which will allow you to create more custom supplemental policies, if you want to.

P.S in Windows 11 24H2, you no longer need to reboot your system to remove the policies completely, they can be removed instantly.