Configuring and managing WDAC
In a nutshell, WDAC works to combat untrusted software, malware, and other vulnerabilities running on your devices. In a trust what you know and know what you trust approach, this means that only known and approved code will be able to run on your devices. This approach is super useful in high-security departments or government agencies, as you are equipped with an incredible amount of control over what can and cannot run.
For the most part, Windows Store apps, signed drivers, Windows operating system base components, Configuration Manager clients and software deployments, and updates that target standard Windows components are all marked as allowed and can run. The key differentiator with WDAC is that this feature makes use of the Microsoft Intelligent Security Graph, allowing you to trust applications that have been vetted by Microsoft and reducing your overall WDAC policy management.
We can utilize several deployment methods to deploy WDAC policies...