This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 9%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIV%3C/text%3E%3C/svg%3E)
Howdy all,
Currently building Windows Defender Application Control (WDAC) for my pilot environment.
Windows 10 x64 20H2, Azure AD, Endpoint Manager (Intune).
I have a WDAC policy in place which allows C:\Windows*.
This should cover this file, but I am getting a log in Event Log every second.
Event Log: Microsoft-Windows-CodeIntegrity/Operational
Event Source: CodeIntegrity
Event ID: 3033
Message: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\audiodg.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\FMAPO64.dll that did not meet the Enterprise signing level requirements.
The DLL file in question, FMAPO64.dll, this file came with Windows 10 (or was downloaded via Update).
It has several Digital Signatures, and a few of them say they're valid.
[Digest algorithm] - [Timestamp] - [Valid] - [Valid to]
sha256 - 2020-06-23 5:40:08 PM - No (This certificate has expired or is not yet valid) - 1/02/2021
sha256 - 2020-09-04 6:57:33 PM - Yes - 6/03/2021
sha256 - 2020-08-28 4:22:05 PM - Yes - 6/03/2021
sha256 - 2020-08-21 6:25:18 PM - Yes - 6/03/2021
sha256 - 2020-08-06 12:41:29 PM - No (This certificate has expired or is not yet valid) - 1/02/2021
sha256 - 2020-07-24 5:28:41 PM - Yes - 6/03/2021
sha256 - 2020-06-29 1:13:27 PM - Yes - 6/03/2021
I have even added a rule via New-CIPolicyRule -DriverFilePath .\FMAPO64.dll -Level FileName -AppID .\audiodg.exe, which appears to use the OriginalFilename from each file (I doubt that's an issue), but the Event Log is still generated.
I am hesitant to create a Hash rule as this file may update in the future.
What can I do?
My Event Log is filled with this log every second, and fills up my log, preventing meaningful troubleshooting of all my other policies.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(249.60000000000002, 39%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
@Ian V Kindly note Windows Security is currently not supported on Microsoft Q & A Community Platform. For expert assistance on your issue, I would suggest you to post your question on Windows Security Community Forum.