Introduction

Microsoft has recently introduced significant changes to Windows Application Control for Business, focusing on a new Certificate Authority (CA) handling logic. This overhaul aims to bolster security by refining how digital certificates are managed and validated within Windows environments.

Background on Windows Application Control

Windows Application Control, formerly known as Windows Defender Application Control (WDAC), is a security feature that allows organizations to control which applications and drivers can run on their systems. By defining policies that specify trusted applications, it helps prevent unauthorized or malicious software from executing, thereby enhancing endpoint security.

The New CA Handling Logic

Key Changes

  1. Introduction of a New Certificate Authority: Starting June 9, 2025, Microsoft will begin using a new CA, named "Microsoft Windows Component Preproduction CA 2024," for signing pre-production drivers. This change is necessitated by the impending expiration of the existing PCA 2010 certificate in July 2025. (techcommunity.microsoft.com)
  2. Decoupling Driver Validity from CA Expiration: Previously, the validity of pre-production drivers was tied to the expiration of the signing CA. Under the new system, drivers signed after June 9, 2025, will remain valid regardless of the CA's expiration, simplifying lifecycle management and reducing administrative overhead. (techcommunity.microsoft.com)
  3. Mandatory Updates for Trust Remapping: To ensure seamless integration of the new CA, Microsoft has scheduled critical servicing releases on April 22, May 13, and June 10, 2025. These updates will remap existing CAs to the new CA in Windows Defender Application Control (WDAC) and Application Control for Business policies. Organizations must apply these updates to maintain trust for pre-production drivers. (techcommunity.microsoft.com)

Implications and Impact

Enhanced Security

By introducing a new CA and decoupling driver validity from CA expiration, Microsoft aims to strengthen the security posture of Windows environments. Regularly updating certificate infrastructure mitigates risks associated with long-lived root certificates, which can become vulnerable over time. (techcommunity.microsoft.com)

Simplified Management

The decoupling of driver validity from CA expiration reduces the risk of test infrastructure disruptions due to expired certificates. This change simplifies lifecycle management and provides a more predictable validation workflow for hardware partners and enterprises. (techcommunity.microsoft.com)

Required Actions for Organizations

Organizations must:

  • Apply Scheduled Updates: Ensure that the critical servicing releases on April 22, May 13, and June 10, 2025, are applied to all relevant systems to remap trust to the new CA. (techcommunity.microsoft.com)
  • Update Pre-Production Drivers: Re-sign any pre-production drivers with the new CA after June 9, 2025, to maintain their validity beyond the expiration of the PCA 2010 certificate. (techcommunity.microsoft.com)

Technical Details

Certificate Mapping Methods

The update introduces changes to certificate mapping methods to enhance security. The default value for the INLINECODE0 registry key has been updated to 0x18, enabling only strong mapping methods. Organizations should review and adjust this setting as needed to align with their security policies. (support.microsoft.com)

Registry Key Configurations

To manage the enforcement mode of the Key Distribution Center (KDC), the INLINECODE1 registry key can be configured with the following values:

  • 0: Disabled mode (not recommended).
  • 1: Compatibility mode (default).
  • 2: Full Enforcement mode.

Administrators should set this key to the appropriate value based on their organization's security requirements. (support.microsoft.com)

Conclusion

The new CA handling logic in Windows Application Control represents a significant step forward in enhancing the security and manageability of Windows environments. By proactively updating certificate infrastructures and refining validation processes, Microsoft aims to provide a more robust defense against unauthorized software and potential vulnerabilities. Organizations are encouraged to stay informed about these changes and take the necessary actions to ensure a smooth transition.