Version History

Version 3.2.0 — Latest

App Control Deep-Dive: six new workflow features and a completely rebuilt ticket-attachment export pipeline. This is the biggest App Control release since 3.1.0.

🔍 Six new App Control features

• Vendor & Product picker for Advanced Hunting. A new FluentWindow popup with a cached publisher / product list scopes your Day-1 hunts without hand-writing KQL. Comes with a new preset that filters events to a chosen publisher/product tuple.
• Audit-mode banner + per-policy Mode / Signed columns. The Overview page now shows Audit vs Enforced at a glance across every loaded WDAC policy. Each row has a Mode pill and a Signed pill derived from the parsed CMS signature — no more guessing whether a .cip is actually signed.
• Impact Scanner (renamed from File Scanner). Load any policy, scan a folder or the entire local machine, and see predicted Allow / Would-Block / Would-Audit outcomes per file. Uses the same comparer as Advanced Hunting so predictions agree across both surfaces. First-run gets a guided tour.
• Fleet Impact toggle in Advanced Hunting. A single click swaps the KQL preset to a unique-binary, device-aggregated query — the "should I deploy this policy?" view. Surfaces would-block %, devices affected, and top blocked vendors in a new summary panel.
• Policy Diff & Merge popup. Compare N loaded policies with per-rule In-All / Only-in-some / Conflict classification, then merge into a single fresh SiPolicy XML with regenerated IDs. Available from both the Advanced Hunting page and the Application Control Policies page.
• PDF ticket reports — completely redesigned. First-page dashboard with a HEALTHY / REVIEW / DEGRADED verdict banner, pillar chips, counter tiles, and severity legend. Table of contents with real page numbers. PDF bookmarks per section, and per-WDAC-policy child bookmarks so a 20-policy machine is navigable from the outline pane. Repeating table headers on multi-page tables. Footer with machine name + timestamp on the left and Page X of Y on the right.

📎 New "Export Report" dialog (replaces "Save PDF for ticket…")

• Format: PDF only, HTML only, or both.
• Sections: 19 checkboxes with All / None shortcuts so you can strip a report down to just Dashboard + Defender + WDAC for a targeted attachment.
• Redaction: machine name, UPN, IP addresses. Applied to both the PDF and HTML output plus the raw JSON snapshot (if requested), so nothing sensitive leaks in a single-file attachment.
• Extras: also emit a raw *.json snapshot next to the report(s) — useful when Tier III wants to re-analyze the collection.
• Post-actions: open when done / reveal in Explorer.
• Preferences persist across launches (%LocalAppData%\MDE-Monitoring-App\export-prefs.json).

🌐 HTML export (new)

Single self-contained .html file — no frameworks, no external assets, no CDN references. Same "attach it to a ticket, no assets folder" story as the PDF.

• Sticky toolbar with page-wide search, Expand / Collapse-all, and Print.
• Sticky table of contents that jumps cleanly to sections (proper scroll-margin-top so anchors don't land under the sticky nav).
• Every section is a <details> — WDAC policies collapse by default so a 20-policy machine still opens on one screen.
• Sortable tables — click any column header. Numeric columns are detected and sorted numerically.
• Dark-mode CSS via prefers-color-scheme.
• Print stylesheet strips interactive chrome for clean printouts.

📝 Triage Report HTML modernized

The Triage Report's HTML output now uses the same visual language as the Export Report — dark-mode, sticky TOC, verdict banner, collapsible sections, sortable tables, in-page search. The Save-File dialog now defaults to HTML with Markdown as the second option. Markdown output is unchanged for pasting into ticket bodies (still renders natively in ServiceNow, Azure DevOps, GitHub, Confluence).

🖥️ CLI parity with the GUI

The silent-mode App.xaml.cs handlers are now rewired through the same ExportReportAsync pipeline the GUI uses. Everything the dialog offers is exposed as a flag:

• --export-html <file> — HTML mirror of --export-pdf.
• --format <pdf|html|both> — explicit format selection.
• --include-json — also emit the raw *.json snapshot.
• --redact <list> — comma list: none / all / machine / upn / ip / serial.
• --include-sections <list> — comma list of section names, or all / default / none.

Backwards compatible: --export-pdf alone still produces exactly one PDF at the given path. Batch mode (--machines-file / --export-dir) now honours every new flag; per-host filenames get the appropriate extensions when --format both is used.

🔧 Fixes

• Export Settings window now scrolls when short (was clipping the action bar).
• HTML Policies and Device Control Events tables were rendered empty due to wrong property lookups — now populated correctly.
• HTML navigation links landed one section off — fixed via scroll-margin-top.
• PDF and HTML verdicts could disagree — both now use the same classifier (RTP, Cloud, Tamper, Firewall, Platform / Engine currency).
• Overview Enforced / Audit counters always showed 0 — the getter was reading Status text; it now inspects PolicyObject.Rules for OptionType.EnabledAuditMode.
• Policy Diff popup missing scrollbar / too small — fixed with MinHeight / MinWidth plus a bounded picker.
• Dispatcher-marshal race when browsing folder from a background thread.
• Audit banner text was washed out on some themes — explicit foregrounds per severity.
• CMS-signed pill correctly reflects signed .cip policies.

👤 For Administrators

• MSI: MDE-Toolkit-3.2.0.msi
• Detection registry key: HKLM\SOFTWARE\MDE-Toolkit\Version = 3.2.0
• Silent install: msiexec /i MDE-Toolkit-3.2.0.msi /qn
• Upgrade behavior: Drop-in upgrade from any 3.0.x / 3.1.x. No new permissions, no schema changes, no re-deploy.
• Scheduled tasks: Existing --collect / --upload tasks are unchanged. New export flags are additive.
• Programmatic API: MainViewModel.ExportPdfAsync remains available for existing automation. New code should prefer ExportReportAsync.

⚠️ Known limitations

• The Redact serial number checkbox in the Export dialog is currently a placeholder — no serial-number field exists on the snapshot yet, so ticking it is a no-op. All other redaction toggles are fully functional.

Download 3.2.0 from GitHub All download options

Version 3.1.1

New App Control for Business → Advanced Hunting sub-page that pulls live WDAC events from Microsoft Defender for Endpoint, compares them against your local or custom App Control policies, and recommends the right allow rules to author — with the same -Level / -Fallback precedence semantics as PowerShell New-CIPolicy.

✨ New: App Control for Business — Advanced Hunting

• Direct Advanced Hunting integration. Sign in with MSAL and pull WDAC events (DeviceTvmInfoGathering, audit / enforced blocks, signing-info, script blocks) from the Microsoft Defender for Endpoint Advanced Hunting API. All four sovereign clouds are supported out of the box: Commercial, US Gov GCC, US Gov GCC High, and US Gov DoD — the right endpoint and authority host are picked automatically.
• 21-column KQL projection. The default query mirrors the WDAC-Toolkit guidance exactly: timestamp, device, action type, file name / folder, SHA1 / SHA256 / AuthenticodeHash, issuer + publisher + their TBS hashes, OriginalFileName / ProductName / InternalName / FileDescription / FileVersion, PolicyId / PolicyName, and EtwCorrelationId. Hex values render in Consolas so they line up.
• KQL editor + presets. Built-in editor with one-click presets (All / Blocks only / Audits only / Scripts only / Signing info) that swap the ActionType filter via regex so your custom WHERE clauses survive. Save / load .kql files to share queries with the team.
• Compare against local or custom policies. Load every .cip in C:\Windows\System32\CodeIntegrity\CIPolicies\Active plus SiPolicy.p7b in one click, or browse to a folder of .cip / .p7b / .xml policies (recursive optional). Each event is evaluated as Allowed, Denied (explicit), or Would Still Block across every selected policy. Explicit Deny wins over Allow anywhere in the set, matching how WDAC merges policies at runtime.
• Action plan card. Rolls up the unresolved events into a plain-English plan: how many unique Publisher / FileAttribute / FilePath / Hash rules you’ll need to author, how many Microsoft-signed / kernel / script events were filtered out, and which policies are doing the heavy lifting (per-policy coverage bar).

🔀 Rule precedence (PowerShell -Level / -Fallback)

• All 13 documented file-rule levels are supported. Hash, FileName, FilePath, SignedVersion, Publisher, FilePublisher, LeafCertificate, PcaCertificate, RootCertificate, WHQL, WHQLPublisher, WHQLFilePublisher, and PFN.
• Admin-configurable precedence. The Policies side-drawer has a new Rule precedence expander with a single list of all 13 levels. Drag rows or use ▲ / ▼ to re-rank them; the top entry becomes -Level and the rest become -Fallback in order. A live Consolas-styled preview shows the resulting PowerShell-equivalent command. Order is persisted to %LOCALAPPDATA%\MDE-Toolkit\advanced-hunting-prefs.json.
• The recommender walks your order, not a hard-coded one. For each event the comparer picks the first level the Advanced Hunting data actually has enough metadata to satisfy — just like New-CIPolicy. Defaults to Microsoft’s recommended FilePublisher → Publisher → SignedVersion → FileName → Hash → FilePath on first launch.
• Hash > FilePath when both are available. Hash pins exact bytes, so it’s now preferred over FilePath even for admin-only folders. FilePath only wins when the event has no usable hash at all.

🔐 Smarter, safer rule generation

• Dual SHA256 + SHA1 hash rules. When both hashes are present in the AH event we emit one <Allow> per algorithm (SHA256, SHA1, and their Authenticode variants). App Control evaluates the strongest hash first and ignores any algorithm the running kernel can’t compute, so emitting every variant maximises match rate — exactly what PowerShell New-CIPolicy -Level Hash produces.
• No more empty hash rules. If an event truly has no hash at all (SHA256 / SHA1 / Authenticode all missing), the recommender flags the row for manual review and the exporter writes a clearly-broken placeholder with a <!-- WARNING --> comment instead of an empty Hash="".
• Risk badge now follows the rule type, not just the file location. A SHA256 Hash rule for an unsigned binary in %LOCALAPPDATA% is no longer flagged — Hash pins exact bytes regardless of where the file lives. The RISK badge now only appears for FilePath rules in user-writable folders, FileAttribute / FileName rules for unsigned files in user-writable folders, or anything kernel-mode (.sys).
• Compact, deduplicated supplemental policy export. The supplemental .xml exporter now emits one short section header per rule type (Publisher / FileAttribute / FilePath / Hash) instead of repeating each fragment’s own multi-line comment dozens of times. Files exported with lots of Hash recommendations are dramatically smaller while still being valid input for ConvertFrom-CIPolicy.

🎨 UI polish

• Three slide-in side drawers on the AH page (Advanced & KQL, Policies, Export) driven by toolbar toggle buttons with mutual exclusivity — opening one closes the others.
• Event detail drawer with Prev / Next navigation, resizable thumb (width persists), opens on double-click or Enter.
• Filter bar (search, ActionType, Disposition, Hide Microsoft-signed, Group by Publisher) plus per-row badges (MS / KERNEL / RISK), per-row ✓ checkboxes for selective export, and an Action Plan card.
• BasePolicyID picker — dropdown of known base policies plus a Custom GUID field, so the supplemental policy you export is always parented to the right base.

🛠️ Under the Hood

• New AdvancedHuntingService built on Microsoft.Identity.Client 4.76.0 (interactive auth, FOCI client ID, per-cloud authority + resource URIs, legacy WDATP endpoint fallback).
• New AppControlPolicyComparerService uses Microsoft.Security.CodeIntegrity 3.1.1 to parse .cip / .p7b / .xml policies; sanitises unknown <Option> values so newer Wizard-generated policies load cleanly.
• Bumped application, installer, About screen, and website to 3.1.1.

👤 For Administrators

• MSI: MDE-Toolkit-3.1.1.msi
• Detection registry key: HKLM\SOFTWARE\MDE-Toolkit\Version = 3.1.1
• Silent install: msiexec /i MDE-Toolkit-3.1.1.msi /qn
• Upgrade behavior: The MSI major-upgrade rule automatically uninstalls any 3.0.x / 3.1.0 build when 3.1.1 is installed — no manual cleanup needed.
• New API permission for the Advanced Hunting page: the operator running the app needs Defender for Endpoint AdvancedHunting.Read (delegated). Interactive sign-in walks them through consent on first use; no app registration is required for the default first-party client.
• Preferences file: %LOCALAPPDATA%\MDE-Toolkit\advanced-hunting-prefs.json stores the chosen cloud, tenant, KQL window, custom policy folder, and the rule-precedence order.
• Scheduled tasks & collector behavior: Unchanged from 3.1.0. Existing Intune / SCCM / GPO deployments and Function App ingestion continue to work without changes.

Download 3.1.1 from GitHub All download options

Previous Releases

Full release notes and downloads for older versions live on the GitHub releases page.

View all releases on GitHub →