Supplemental WDAC policy Doesn't Override Block Rule from Base WDAC Policy

Supplemental WDAC Policy Doesn't Override Block Rule from Base WDAC Policy

If you are new to Windows Defender Application Control (WDAC), it is a security feature in Windows 10 that helps protect your computer from running malicious software. WDAC uses a set of policies to determine which applications are allowed to run on your system. These policies are defined in a Windows Defender Application Control policy file, which contains a list of rules that specify what can and cannot run on your computer.

One important concept to understand when working with WDAC policies is the idea of a base policy and a supplemental policy. The base policy is the main policy that defines the default behavior for your system. It contains a set of rules that determine which applications are allowed to run. On the other hand, a supplemental policy is an additional policy that can be applied to your system to add or modify rules from the base policy.

Now, let's say you have a base WDAC policy that includes a rule to block a specific application from running on your computer. This rule is there to ensure that the application is not executed due to security concerns. However, you also have a supplemental WDAC policy that includes a rule to allow the same application to run.

At first glance, you might think that the supplemental policy would override the block rule from the base policy, and the application would be allowed to run. However, that is not the case. The supplemental WDAC policy does not have the ability to override a block rule from the base policy. The block rule always takes precedence over any allow rules in the supplemental policy.

So, what happens when you have both a block rule in the base policy and an allow rule in the supplemental policy for the same application? In this scenario, the block rule will be enforced, and the application will not be allowed to run. The allow rule in the supplemental policy will be ignored.

This behavior is by design to ensure the highest level of security for your system. It prevents any potential conflicts between the base and supplemental policies and ensures that the block rules defined in the base policy are always enforced.

If you want to allow an application that is blocked by the base policy, you will need to modify the base policy itself. You can either remove the block rule from the base policy or create a new rule that allows the application to run. Simply adding an allow rule in a supplemental policy will not override the block rule from the base policy.

It is important to note that modifying the base policy should be done with caution, as it can have implications for the security of your system. Before making any changes, it is recommended to thoroughly evaluate the application you want to allow and consider any potential security risks.

In conclusion, the supplemental WDAC policy does not have the ability to override a block rule from the base policy. The block rule always takes precedence over any allow rules in the supplemental policy. If you want to allow an application that is blocked by the base policy, you will need to modify the base policy itself. This ensures the highest level of security for your system and prevents any conflicts between the base and supplemental policies.

References