WDAC policy created in App Control Wizard merged with User Mode Block Rules does not block executables like wscript

Question

I created a WDAC policy using the Default Windows Mode in App Control Wizard. When I tick the option to merge User Mode Block Rules, it creates the .xml that I deploy via Intune.

After deploying, non-Microsoft apps like TeamViewer are blocked which is good but wmic.exe, wscript.exe, cscript.exe are still running when they should be blocked.

What can I do make sure the block list applies?

I basically need to implement this block list via WDAC and Intune Applications that can bypass App Control and how to block them | Microsoft Learn. Is there any other way?

Thanks

Answer 1

Prefer hash-based or publisher-based deny rules when possible.

You can use PowerShell command:

New-CIPolicyRule -FilePath "C:\Windows\System32\wmic.exe" -Deny

After deploying via Intune, use this on a client to verify what policy is applied:

Get-WdacPolicy -PolicyType Base | Format-List