Skip to content

Latest commit

 

History

History
211 lines (147 loc) · 6.07 KB

Audit Default Deny.md

File metadata and controls

211 lines (147 loc) · 6.07 KB

Device control policy sample: Audit Default Deny

Description: This is a policy.
Device Type: Windows Printer

A device control policy is a combination of policy rules, groups and settings.
This sample is based on the sample files.
To configure the sample, follow the deployment instructions.

Policy Rules

Name Devices Rule Type Access Notification Conditions
Included Excluded Print
Default Deny
      		Audit Denied 📄 Show notification and Send event (3) -

      Groups

      Settings

      Setting Name Setting Value Description Documentation
      DefaultEnforcement Deny Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched. documentation
      DeviceControlEnabled True Enables/disables device control documentation

      Files

      This policy is based on information in the following files:

      Deployment Instructions

      Device control policy rules and groups can be deployed through the following management tools:

      Windows

      Intune UX

      Create a Device Control Rules configuration profile
      1. Navigate to Home > Endpoint Security > Attack Surface Reduction
      2. Click on "Create Policy"
      3. Under Platform, select "Windows 10 and later"
      4. Under Profile, select "Device Control Rules"
      5. Click "Create"
      6. Under Name, enter **
      7. Optionally, enter a description
      8. Click "Next"
      Add a rule for Default Deny to the policy

      1. Click on "+ Edit Entry"

      2. Enter Default Deny for the name

      3. Select Audit Denied from "Type"

      4. Select Show notification and Send event from "Options"

      5. Select Print from "Access mask"

      6. Click "OK"

      Group Policy (GPO)

      Define device control policy groups
      1. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Device Control > Define device control policy groups.
      2. Save the XML below to a network share.
      <Groups>
</Groups>
      1. In the Define device control policy groups window, select Enabled and specify the network share file path containing the XML groups data.
      Define device control policy rules
      1. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Device Control > Define device control policy rules.
      2. Save the XML below to a network share.
      <PolicyRules>
	<PolicyRule Id="{e6ccf2cb-20d6-4478-bf2d-66f247ced6f3}" >
		<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7Be6ccf2cb-20d6-4478-bf2d-66f247ced6f3%7D/RuleData -->
		<Name>Default Deny</Name>
		<IncludedIdList>
		</IncludedIdList>
		<ExcludedIdList>
		</ExcludedIdList>
		<Entry Id="{6b9cf286-ec70-4463-bfaf-29f32bb5f0dc}">
			<Type>AuditDenied</Type>
			<AccessMask>64</AccessMask>
			<Options>3</Options>
		</Entry>
	</PolicyRule>
</PolicyRules>
      1. In the Define device control policy rules window, select Enabled, and enter the network share file path containing the XML rules data.

      Intune Custom Settings

      Create custom intune configuration
      1. Navigate to Devices > Configuration profiles
      2. Click Create (New Policy)
      3. Select Platform "Windows 10 and Later"
      4. Select Profile "Templates"
      5. Select Template Name "Custom"
      6. Click "Create"
      7. Under Name, enter **
      8. Optionally, enter a description
      9. Click "Next"
      Add a row for Default Deny

      1. Click "Add"

      2. For Name, enter Default Deny

      3. For Description, enter **

      4. For OMA-URI, enter ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7Be6ccf2cb-20d6-4478-bf2d-66f247ced6f3%7D/RuleData

      5. For Data type, select String (XML File)

      6. For Custom XML, select windows/printer/Intune OMA-URI/Audit Default Deny.xml

      7. Click "Save"

      Add a row for DefaultEnforcement

      1. Click "Add"

      2. For Name, enter DefaultEnforcement

      3. For Description, enter **

      4. For OMA-URI, enter ./Vendor/MSFT/Defender/Configuration/DefaultEnforcement

      5. For Data type, select Integer

      6. For Value, enter 2

      7. Click "Save"

      Add a row for DeviceControlEnabled

      1. Click "Add"

      2. For Name, enter DeviceControlEnabled

      3. For Description, enter **

      4. For OMA-URI, enter ./Vendor/MSFT/Defender/Configuration/DeviceControlEnabled

      5. For Data type, select Integer

      6. For Value, enter 1

      7. Click "Save"