How to Configure Device Guard and Application Control Policies via Intune for SMBs. Prevent untrusted or unauthorized apps from becoming unwanted entryways. Here’s how you can use Microsoft Intune to configure and enforce Device Guard and application control policies. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. What are Device Guard and Windows Defender Application Control? Device Guard is a set of Windows security technologies that combines Credential Guard, Code Integrity, and Application Control for Windows (formerly Windows Defender Application Control or WDAC), to enforce a Zero Trust execution model where only trusted applications are allowed to run. These technologies can be configured and deployed using Intune, PowerShell, or Group Policy, depending on your environment. Three Methods to Configure and Deploy Application Control Policies. Method 1 - Intune, Microsoft Intune is the most scalable method to deploy App Control for Business policies—Microsoft's cloud-managed implementation of WDAC— across cloud-first SMBs and enterprise environments. First, open the Microsoft Intune Admin Center and navigate to Endpoint Security, App Control for Business, Create policy. Then select the platform and profile type before configuring the policy. Use Audit Mode to begin logging blocked activity without actually blocking it, enforce rules after testing, and enable Intelligent Security Graph integration. Then, assign the policy to a test group or a subset of endpoints. Once validated, switch to Enforcement mode to start blocking untrusted apps. Method 2 - PowerShell PowerShell is best used when testing your policy on a limited group or when you want a custom allowlist for high-security environments. Run PowerShell as an administrator, and execute the following command to create a default WDAC policy. Optionally set the policy to Audit Mode before enforcement, then convert the XML policy to a binary file. and enable audit mode only respectively. Method 3 - Group Policy Lastly, Group Policy is best used for hybrid or on-premises AD transitioning from on-prem to cloud. Open Group Policy Editor, navigate to Computer Configuration, Administrative Templates, System, Device Guard, and enable the following policies: Turn on Virtualization-Based Security, Turn on Credential Guard, and Deploy Windows Defender Application Control How to Validate and Confirm App Control Policies. Once you have used one of these three methods, you’ll need to validate the policies. Validate application control with PowerShell and event logs On PowerShell, run this script to confirm WDAC status. this script to check audit logs. and this script to verify Credential Guard. Then, on Event Viewer, navigate to Applications and Services Logs, Microsoft, Windows, CodeIntegrity, Operational, and look for: Event ID 3033 – WDAC policy successfully loaded Event ID 3076 – Application blocked by WDAC (Enforcement Mode) Event ID 3099 – Application would have been blocked (Audit Mode) These events confirm whether the WDAC policy was applied successfully and whether applications were blocked or would have been blocked. Use Registry to confirm or enforce settings. Finally, in the Registry Editor navigate to HKey Local Machine\System\ CurrentControlSet\Control\DeviceGuard, and set the values of the EnableVirtualizationBasedSecurity and RequirePlatformSecurityFeatures D Words to 1. Then, navigate to to HKey Local Machine\ System\CurrentControlSet\Control\Lsa and verify that LsaCfgFlags is set to 1. These values can help confirm or support enforcement of Device Guard, VBS, and Credential Guard settings, but WDAC/App Control policy deployment should still be managed through Intune, PowerShell, or Group Policy. Application control is just one of many ways to secure devices against unauthorized software and potential threats. For more information, check out our official blog post on How to Configure Device Guard and Application Control Policies via Intune linked in the description below.