Application Allowlisting With a Legacy ERP
Contoso Manufacturing has 60 Windows 10 workstations on one AD domain. Every user is a local administrator because an ERP client writes to C:\Program Files\ContosoERP and to HKLM\Software\ContosoERP; the vendor signs the executable. A second business app is an unsigned Excel add-in used by 12 planners. USB storage is enabled for shop-floor quality inspectors who copy measurement files. Three IT staff share the Domain Admins account. A peer manufacturer was hit by ransomware that ran from a user's Downloads folder. The CIO mandates application allowlisting within 30 days, but the ERP vendor will not support a changed install path. The shop-floor manager refuses to give up USB drives. You have Microsoft Defender for Endpoint and Intune but no third-party EDR.
1. Choose between AppLocker and WDAC for the 30-day rollout. Justify the choice against the ERP and unsigned add-in constraints, and state the enforcement mode sequence.
Read the worked answer
Choose WDAC. AppLocker is easier and can be deployed by GPO quickly, but its path and publisher rules are weaker against a local administrator, and the shared Domain Admins membership means an attacker can often edit AppLocker policy or place binaries in allowed paths. WDAC enforces kernel-mode code integrity, supports signed publisher rules, and can be managed through Intune.
The ERP constraint is workable because the vendor signs the executable: create a publisher rule for the ERP certificate and allow the app's install directory only as a narrow path rule if the installer writes unsigned DLLs. Do not allow C:\Program Files broadly. The unsigned Excel add-in cannot be publisher-allowed; handle it as a documented exception, not by weakening the whole policy.
Sequence: inventory and hash all business binaries; deploy WDAC in audit mode for two weeks; review 4688/Sysmon and WDAC audit events; move to enforced on a pilot ring of 10 workstations; then all 60. Keep a signed managed-installer path for Intune-delivered software. Measure blocked executions, help-desk tickets, and ERP launch success. Audit mode is essential because the 30-day deadline is too short to discover every DLL by policy alone.
2. Address the local administrator and shared Domain Admins problems without breaking the ERP client. Give concrete controls and a migration order.
Read the worked answer
Remove local admin from all users, but first fix the ERP requirement so the app does not need it at runtime. Package the ERP client with the vendor's guidance, apply an AppCompat shim, or grant write access only to the specific registry key and folder via a restricted group or endpoint privilege management tool.
Sequence: (1) inventory who actually uses local admin and for what; (2) create a privileged access workstation or Intune-deployed EPM policy for the three IT staff; (3) replace the shared Domain Admins account with named admin accounts, a tier-0 group, and just-in-time elevation; (4) enable LAPS for local admin passwords; (5) pilot removal on five users with the ERP fix; (6) remove from the rest. Keep one break-glass local admin per machine with LAPS.
Do not leave the shared Domain Admins account as a fallback; that defeats the purpose. The migration order matters: fix the app before removing the right, or users will demand the right back. Log 4672 and 4688 to catch residual admin use.
3. The unsigned Excel add-in must remain usable. Propose an allow strategy and compensating controls, and explain the residual risk.
Read the worked answer
Allow the add-in by an explicit hash or a file-path rule in WDAC, scoped to the 12 planners' OU or a dedicated device group, not domain-wide. Stronger: obtain a signed version from the developer, or repackage the add-in into a signed MSI and use a publisher rule.
Compensating controls: mark the file read-only, restrict write access to the add-in folder to IT, block Office macros from the internet, enable ASR rules for Office child processes, and monitor the add-in's hash for change. Put the 12 planners in a separate ring so a policy exception does not cover finance or engineering.
Residual risk: an unsigned add-in can be replaced by anyone who can write to its path; a hash rule breaks on every update; a path rule allows any binary in that folder. Neither proves the add-in is benign. Accept the risk only with owner sign-off, a review date, and alerting on file modification and on Office spawning powershell.exe. Revisit when the vendor provides a signed build.