Managing the Windows App Store Rapid Config

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to enable and configure the Windows App Store Rapid Config.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Log in to the Console and navigate to: Rules > Software Rules > Rapid Configs.
2. Locate Windows App Store in the list, click View Details (pencil icon) and verify:
   • Status: Enabled
   • Application Directory: <add any additional paths that are required>

     Defaults:
     <programfiles>\windowsapps\microsoft.*
     <programfiles>\windowsapps\microsoftteams.*
     
     Example Extras:
     *\windowsapps\appup.intelgraphicsexperience*

   • Settings Apply To: <relevant Policies>
3. Click Save.

Notes:

• This Rapid Config will issue a Local Approval when files are written to the specified path.
• If files are already written to the specified Application Directory, this will not retroactively issue a Local Approval.

 

Additional Information

• More details can be found on VMware Docs > Rules Installer Documentation > Rapid Config Guide.
• If existing files in the \windowsapps\ directory need to be executed either:

  • Issue a Local Approval for existing files:

    1. Navigate to Assets > Files > Files on Computers > Filters > Add Filters:
       
       • File Path > begins with: <relevant Path>
       • Local State > is: Unapproved
       • Computer > is: relevant Computer
    2. Apply
    3. Select one or more of the filtered files
    4. Action > Locally Approve

  • Temporarily create an Execution Control > Allow Rule:

    1. Verify the File Path and Process from the Block Event in Reports > Events.
    2. Navigate to Rules > Software Rules > Custom > Add Custom Rule:
       • Rule Name: TMP - Allow Execution of <relevant app> (or something memorable)
       • Status: Enabled
       • Platform: Windows
       • Rule Type: Execution Control
       • Execute Action: Allow
       • Path or File: <relevant path pattern>
       • Process: <relevant process>
       • User or Group: Any
       • Applies To: <relevant Policies>
    3. Save & Exit.