Windows 10 Fall update 1709 Security Feature 1: Windows Defender Application Guard

Microsoft celebrated my birthday and released the new Windows 10 fall update on October 17, 2017 with many new exciting features and updates especially in the security field which will be our main concern in this series of articles. My intent is to go through each new Security feature targeted to Endpoint users (Windows 10 users) one by one in a separate blog post and we will start today with the Defender Application Guard.

What is the Windows Defender Application Guard ?

Windows Defender Application Guard is a new security feature in Windows 10 1709 integrated in Edge Browser (Edge only for now) that allows you and your users to browse suspicious / unreliable sites and review them without affecting or exposing your operating system to any hurt.

This happens with the beauty of virtual machines (Windows Hyper-V) opening the Edge browser in application protection mode that simply opens the browser in an isolated virtual machine that totally isolates this site / open websites by the protection mode of defense applications reaching the main components of your operating system, as well as your files and data. Once the Edge browser is closed (virtual machine is turned off), all the data on the site is opened and the browser is erased and erased completely.

What are the modes of Defender Application Guard ?

Windows Defender Application Guard comes in two flavors:

Standalone: The user will manually start the Edge in Application Guard mode when he is feeling suspicious regarding opening a specific website and would like to test it in secure mode. There are no policies (Organization forced Group policies) governing this, its just the user perspective.
Enterprise: The organization will set rules and policies to identify trusted sites and un-trusted sites. When users tries to open one of these un-trusted sites, these URLs will be loaded in the Application Guard Edge mode (Isolated Virtual Machine)

How to Install Application Guard ?

In General application Guard requires a computer capable to run virtualization, remember the Application guard will leverage the Virtual Machine technology to isolate your suspicious URLs. Machines need to be 64 bit with Virtualization extensions support and some RAM for the Virtual machine (Microsoft recommendation is to have a system with at least 8 GB RAM)

Application Guard is disabled and you need to enable it from Control Panel - Turn Windows Features on or off.

After enabling the feature, it will get installed and requires reboot.

You can install it also using Powershell and link it to group policy if needed for mass distribution.

For more info check the below article

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-application-guard/install-wd-app-guard

How will the user open Edge Application Guard (Standalone) ?

As agreed before, in the standalone mode, the user will manually open the Edge browser in Application Guard mode to examine and open any suspicious URL

The User will open normal Edge browser - Settings - New Application Guard Window
It will take few minutes when you open it for the first time as it prepares the environment and loads the isolated virtual machine. Later on when you open another URL it will work faster since the environment is already set and VM is up and running.
A new Edge browser is loaded with Application Guard enabled (Top Left)

How to apply the Application Guard for Enterprise Users ?

So this is the second mode we discussed which is applying the application guard settings for the enterprise using group policies.

Installation of Application Guard as discussed earlier by enabling the respective windows feature.
For Enterprise users we will be controlling the settings using Group policies and for this reason we need to download the latest Windows 10 1709 Group policy Administrative templates (ADMX and ADML) and copy them to the Domain Controllers Central store.
To download the latest 1709 administrative template, please check the link below https://www.microsoft.com/en-US/download/details.aspx?id=56121
By default the files will be installed under C:\Program Files (x86)\Microsoft Group Policy\Windows 10 Fall Creators Update (1709)\PolicyDefinitions.
Copy the Admx files under Local folder Policy definitions (mentioned in step 4) to the Central store (I hope everyone is using central store) Policy definitions under \\domain.com\SYSVOL\Domain.com\Policies\PolicyDefinitions
Repeat the same for the Adml files from the local folder mentioned in step 4 under PolicyDefinitions\en-US to \\domain.com\SYSVOL\Domain.com\Policies\PolicyDefinitions\en-US. This will ensure your domain controllers have the latest needed templates for the network Isolation group policies.
Next we need to set the Network Isolation policies for the computers. You need to create a new Group policy for the computers OU - Edit Policy - Computer Configuration - Policies - Administrative Templates - Network - Network Isolation
There are two main settings that you need to configure as shown in the above image Enterprise Resource Domain hosted in the cloud: These are enterprise approved Cloud resource domain URLs that will be opened in the normal Edge, for example *.yourcompany.com or/and *.partner.com...........etc Domains Categorized as both work and personal: You can add list of your internal or external work domains as well as personal domains used by users to be safely opened by normal Edge browser.
Next step is to enable the Application Guard for Enterprise mode using group policy settings from Administrative Templates - Windows Components - Windows Defender Application Guard
Other settings in the same location (Step 9) allows you to set the behavior of copying and pasting from sites opened in Application Guard with other components in Desktop as well as print settings. You can enable or disable copying from this virtualized container to other systems.

So this concludes the first blog post in our new Windows 10 version 1709 Security features. Hopefully you are getting excited and see you on our next episode.