App Control (WDAC) insights guide: v2.0 - script enforcement, COM class resolution, refreshed screenshots

[Carlos Mayol (MSFT) (carlosmayol)]

App Control (WDAC) insights guide: v2.0

Updates the App Control insights guide so it also covers script enforcement, which the current version does not report anywhere.

What's new

• Script Enforcement tab — audit and block activity for scripts and MSI files across Windows PowerShell 5.1 and PowerShell 7.x, with activity over time, a per-machine breakdown, the publishers seen most often, a detail log, blocked COM classes, and a CSV export.
• Publishers identified on script events — script events are matched to their signing event, so the tab shows who signed a script instead of reporting everything as unsigned.
• Blocked COM classes — event 8036 reports only a class identifier. The workbook resolves it to a component name, and the readme explains how to read these blocks and how to allow a class you have decided to trust.
• Better file event views — improved publisher and issuer resolution, new publisher and issuer summaries, duplicate rows removed, clearer audit versus block labelling.
• Focused collection — the data collection rule covers exactly the eight event IDs the workbook reads, across the Code Integrity and AppLocker MSI and Script logs.

Upgrading from v1.x

• The rule now also collects Microsoft-Windows-AppLocker/MSI and Script. App Control shares that log for script enforcement events, so there is nothing to turn on for the log itself. Script enforcement is on by default for every App Control policy unless rule option 11 Disabled:Script Enforcement is set.
• Existing history is preserved and stays queryable.
• If another collection rule already gathers these logs, the events are ingested twice. The workbook removes duplicates so the numbers stay correct, but the duplicate ingestion is billable and worth a deliberate decision.

Rename

DCR-WDAC.json becomes DCR-AppControl.json to match the product name. Every deployment link in the readme is updated, and each one was decoded and checked against the files in this branch.

Screenshots

Captured in light and dark. The readme serves whichever matches the reader's GitHub theme automatically, so no repository configuration is needed. All captures were cropped of portal chrome, and environment-specific values were replaced with customer-oriented placeholders such as Your node and Your workspace.

Validation

• All 24 workbook queries were run against a live Log Analytics workspace with parameters substituted: no errors.
• The workbook, the collection rule, the readme and the changelog were checked to agree on the event set.
• Every readme image reference and every deployment link was checked to resolve.

Review

Simon Jäger (@simonjaeger) for review and approval of the guide.

Jordan Geurten (@jgeurten) — optional, non-blocking: a documentation read on the App Control content would be welcome, particularly the script enforcement and blocked COM class sections. Please don't treat this as a gate on the PR.