App Control for Business (WDAC – Windows Defender Application Control) is an extremely powerful function in Windows 10/11. When set up correctly this pretty much rules out that malware is able to start (or can easily achieve persistence). It can be configured in a way that even a user with local admin privileges becomes unable to change, remove or disable strict rules.
This powerful kernel-mode feature comes at a price. The price is complexity and a steep learning curve. A steep learning curve has never discouraged me despite my serious concentration issues. Once I got into using Qubes OS I never really looked back. My real problem with WDAC lies in it’s complexity.
(more…)