WDAC / AppLocker / Policies

Background

Some organisations implement strict control policies that block applications from running, even when they are digitally signed - these are systems like WDAC (Windows Defender Application Control), AppLocker and AppSense. In these cases, it is common for administrators to manually allow the main P11D Organiser application to run, but this approach does not extend to the suite’s additional utilities and update processes. While it is possible to whitelist each application individually, this method is inefficient and often requires applications to fail before they can be cleared, leading to unnecessary delays and frustration. We have even seen circumstances where an updated application with the same name is blocked due to the timestamp of the digital signature application.

Recommended WDAC Policy Configuration

To streamline application management, we recommend updating your WDAC policy to trust the digital signature of Personal Audit Systems Ltd. By allowing the company’s certificate, any application signed and deployed by Personal Audit Systems Ltd will be permitted to run, eliminating the need to whitelist each component separately. WDAC supports certificate-based rules, enabling administrators to add trusted signers directly to the policy XML file. This approach ensures that all signed files from the vendor are recognised as trusted, improving operational efficiency and reducing administrative overhead.

AppLocker

While AppLocker’s publisher rules can use the timestamp embedded in a digital signature to validate whether a file was signed while the certificate was valid, this is only relevant for verifying the authenticity and validity of the signature, not for blocking files based on when they were created or modified - in these cases, as the digital signature is applied at the date of the software build, it can change, so these should not be used.

Ivanti Application Control (formerly AppSense)

If your organisation uses Ivanti Application Control, a similar strategy is advised. Instead of whitelisting each application individually, configure the system to trust the digital signatures from Personal Audit Systems Ltd. Ivanti Application Control identifies and authorises applications using digital signatures and hashes, which can be managed within its configuration settings. Updating these settings to include our signature will ensure all relevant applications are allowed, maintaining both security and ease of management.