Skip to content

Managed Installer

Windows Defender Application Control (WDAC) relies on Managed Installer to enforce strict controls over how applications are installed on a system. Managed Installer acts as a gatekeeper, ensuring that only authorized installers (such as trusted package managers or signed executables) can execute installation operations. This mechanism is critical for preventing the deployment of untrusted or malicious software, thereby reducing attack surfaces and ensuring compliance with organizational security policies.

Role of Managed Installer in WDAC

Managed Installer integrates with WDAC policies to restrict application installation to predefined, trusted sources. Key responsibilities include:
- Enforcing trusted installers: Only digitally signed or explicitly allowed installers (e.g., Microsoft Store, Windows Package Manager) can execute installation tasks.
- Blocking untrusted sources: Prevents installation from local file paths, untrusted networks, or unsigned executables.
- Policy enforcement: Works alongside WDAC policies to ensure installation operations align with organizational security requirements.

For example, a WDAC policy might explicitly allow installations via the Microsoft Store but block local .exe files, ensuring users cannot bypass security controls by manually installing software.

Importance in Controlling Application Installation

Managed Installer is vital for maintaining a secure environment by:
1. Preventing unauthorized software: Blocks installations from untrusted sources, reducing the risk of malware or rogue applications.
2. Ensuring software integrity: Requires digital signatures from trusted publishers, ensuring installations come from verified vendors.
3. Supporting compliance: Aligns with regulatory and organizational policies that mandate strict control over software deployment.

In enterprise environments, this is critical for maintaining system stability and security, especially when users might attempt to install unapproved software.

Configuration and Enforcement

Managed Installer is configured via Group Policy or WDAC policies. Key steps include:
1. Enable Managed Installer:
Navigate Group Policy settings under Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Control to enable the feature.

  1. Define allowed installers:
    Use the Set-GPRegistryValue cmdlet or Group Policy to specify trusted installers in the registry key:

    HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Defender Application Control\AllowedInstallers

  2. Integrate with WDAC policies:
    When creating a WDAC policy, include rules that explicitly allow or deny specific installers. For example:

    <PolicySchema>
  <Rule Id="AllowMicrosoftStoreInstaller" Action="Allow">
    <Match Id="Installers" Hash="SHA256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef" />
  </Rule>
</PolicySchema>

Example Scenarios

  • Scenario 1: A user attempts to install a third-party application via a local .exe file. Managed Installer blocks the operation, as the installer is not in the allowed list.
  • Scenario 2: An IT administrator configures WDAC to allow only Microsoft Store installations. Users can only install apps through the Store, ensuring all software is vetted.

Key takeaways

  • Managed Installer is a core component of WDAC for controlling application installation.
  • It enforces policies to restrict installations to trusted sources and signed executables.
  • Configuration via Group Policy or WDAC policies ensures alignment with organizational security requirements.
  • Real-world scenarios demonstrate its role in preventing unauthorized software and ensuring compliance.