@flaxking said in Windows Defender Application Control:

@obsolesce said in Windows Defender Application Control:

@ccwtech said in Windows Defender Application Control:

@obsolesce said in Windows Defender Application Control:

@ccwtech said in Windows Defender Application Control:

Has anyone played with Windows Defender Application Control, specifically Group Policy to turn it on for each workstation?

I have a request from a client to do this, but I am very leery of using group policy for something like this.

Are they all running Win 10 Enterprise?

For sure no... Win 10 Pro.

Then it won't work as it's a requirement.

I think specifically it's using Group Policy for WDAC that's enterprise edition only, right?

Yes, you can use it in Pro, just not enforced by a GPO

@black3dynamite said in Windows Server 2019 Need to Download and Run without AV Deleting Files:

https://www.thomasmaurer.ch/2016/07/how-to-disable-and-configure-windows-defender-on-windows-server-2016-using-powershell/

For now, just temporary disable Real-Time Protection via PowerShell
Set-MpPreference -DisableRealtimeMonitoring $true

Download the executable and scan it manually before you install
Start-MpScan -ScanPath C:\datastore\file.exe -ScanType QuickScan

Enable Real-Time Protection after the install
Set-MpPreference -DisableRealtimeMonitoring $false

Excellent, now THAT did it.

@Dashrender said:

MS is finally making Enterprise look like a more worthwhile upgrade, but damn.. still just more money to spend.

That's the Windows world. Commitment to paying for all the little features. Great stuff, but the cost to "do things the Windows way" gets really expensive. And doing anything else leave you without the benefits of the ecosystem that money is being invested into.