Installation

Install it from the Microsoft Store: https://apps.microsoft.com/detail/9png1jddtgp8

Documentation

What's New

• Added a new button to the sidebar that allows you to optimize memory usage of the app and try to reduce it. AppControl Manager is already highly optimized but this gives users more control over its memory usage. The app will generate a detailed report in the Logs page that you can check out, showing the type and amount of memory changes.

• In Scan results, for the Signing Scenario column, the status is now displayed as "UserMode" or "KernelMode". Previously, they would show up as 0 and 1, indicating Kernel Mode and User mode respectively. This change improves readability, user experience and addresses the following community feedback.

• Updated dependencies to the latest versions.

• The View File Certificates page now displays a lot more information about each signer and has the ability to export the results to JSON for backup. It also features a new button that displays CMS details of the selected signed file if present.

• The System Information page now lets you easily open the selected deployed policy in Policy Editor where you can view all of its details, modify it and save it to a file. This is very useful to know what rules are included in the deployed policies on your system. It also supports protected System policies that come by default with the OS.

• AppControl Manager no longer requires SignTool.exe to sign the Code Integrity policies, the required logic has been implemented in it.

• Completely removed SignTool.exe related elements from the UI such as areas where user was asked to provide its path or ability to download it from the NuGet repository.

• This makes AppControl Manager easier to use in completely offline environments.

• Wrote an article demystifying the Code Integrity signing process, which can be found here.

• The Automatic Supplemental Policies feature explained here no longer has an allow rule for SignTool.exe. It also no longer hardcodes the Package Family Name of the AppControl Manager, instead it retrieves it from the currently running app instance. This way the AppControl Manager will be able to run after you deploy any base policy on the local system.

• Disabled Runtime Marshaling for the AppControl Manager project, improving performance and following best practices.

PRs

• #881 by @HotCakeX
• #878 by @HotCakeX
• #876 by @HotCakeX
• #875 by @MarvinDrude

How to verify the MSIXBundle's authenticity:

gh attestation verify "Path To MSIXBundle" --repo HotCakeX/Harden-Windows-Security --format json

You can install the GitHub CLI from Winget:

winget install --id GitHub.cli