Whitelisting Browser causing downloads from that browser to stop working

[smojumder2024]

So, I have been trying to push a standard policy out for our contract employees that only allows basic functions. I have been using the most restrictive version of the policy and only whitelisting Slack, Adobe, Zoom, general MS products, and Google Chrome.

Whenever I downloaded something from both Edge and Chrome, whether it is .exe or a png is says "Couldn't download - Virus scan failed". The only way I fixed it was by actually removing it from the whitelist and turning on the "Managed Installer" option. So, after downloading it from MS Company Portal. Google Chrome worked and was able to download anything I needed.

Now, the problem is a lot of people Edge and since I need to whitelist MS signed applications as that is our productivity suite. I can't just remove it from the whitelist and get it from company portal. Any help would be appreciated.

[jgeurten]

Thanks for reaching out. Application Control (WDAC) does not perform Virus scanning so the issue you are observing is not related to App Control. It appears that would be Defender Anti-virus which is failing to scan thereby blocking your downloads.

[smojumder2024]

Hmm, I thought this would be related to WDAC as it only started happening once I started testing this policy out.

[Patric-Nurczyk]

I have this issue as well, it only happens when I whitelist the browser, when I remove it the browser works and I can download.

[jgeurten]

@smojumder2024 and @Patric-Nurczyk can either of you please share the CodeIntegrity.evtx event logs. I will look into this with Defender

[jgeurten]

@smojumder2024, @Patric-Nurczyk re-opening the issue while I wait for event logs please. Thanks!

[smojumder2024]

Hey sorry for the late response, I ended up changing the mode from Default Windows Mode to Microsoft Allowed mode, which fixed it for a bit. However, since coming in this week it has been blocking everything that is not MS signed such as Chrome and Slack. Downloads still work however I don't understand why it would block chrome.exe when I whitelisted anything that has the Google LLC signature. I will try to get the CodeIntegrity.evtx event logs send it soon.

Thank you for reopening the issue!

[smojumder2024]

Trying to send it over but the file type is not allowed on the comments. If you can provide an email of sorts, I can send it over to you.

[jgeurten]

@smojumder2024 sorry, yes my email is jordan.geurten@microsoft.com