Device Guard block Windows Subsystem for Linux

[Acenl12]

Tools category

Harden Windows Security Script

Does your system meet the requirements?

• Yes, my system meets the requirements 👍

Is your Windows installation genuine?

• Yes, I am using genuine Windows installation. 💯

Please explain the bug

When I try to run a WSL Distro I get the following:

Installing, this may take a few minutes...
WslRegisterDistribution failed with error: 0x800711c7
Error: 0x800711c7 Your organization used Device Guard to block this app. Contact your support person for more info.

Press any key to continue...

Please help in making WSL distro possible to run again.

[HotCakeX]

Hi,
The message "Your organization used Device Guard to block this app" is related to WDAC policy or Smart App Control. Are you using any of them?

Also since this isn't a bug with the module I'm converting this into a discussion.

[HotCakeX]

WSL is in this list

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac

To run WSL, you might need to turn off Smart App Control. The Harden Windows Security module or script don't deploy User Mode block list of Microsoft. Only Smart App Control deploys it or a custom WDAC policy that you deploy.

[Acenl12]

Hi, thanks for the reply. But my point was that after I ran the Device Guard category in your Harden powershell script WSL stopped working,with the error I gave you. I don't know understand why you are talking about WDAC and smart app control.

[HotCakeX]

I explained above that why I talked about WADC and Smart App Control. I know your error says "Device Guard" but that actually means WDAC or features that use it such as Smart App Control. It's not the same "Device Guard category" that is in the module or script.

Everything in the Device Guard category is linked to official Microsoft documents. You can see that none of them block WSL.

For you I created a new VM, fully updated it, applied hardening measures, installed WSL and then installed Ubuntu 22 LTS. It's running fine.

[HotCakeX]

Testing with Debian too, working fine, pretty much everything is enabled in Harden Windows Security module (the missing ones are BitLocker related which I didn't use on VM)

[HotCakeX]

My suggestion is to use WDACConfig module and check for deployed WDAC policies on your system

Install-Module -Name WDACConfig -Force
Confirm-WDACConfig

Maybe you used some other tool before to deploy a policy, I'm not sure