You all know I'm sucker for smart intelligent software and by that mean tools designed correctly philosophical level they solve strategic problems rather than tactical annoyances in Windows two prime examples such design EMET and Exploit Mitigation fire-and-forget security concepts don't use outdated blacklist model filtering out bad software instead use philosophical approach filtering out illegal memory instructions doesn't matter what your app if behaves badly it goes down
This means quite intrigued almost ended up keen reading recently unveiled Microsoft software solution Windows Defender Application Guard uses hardware isolation block threats sounds like my kind of tool no signatures no chasing one's tail instead isolated browsing instances whatever happens inside stays inside like Las Vegas so started testing
Application Guard setup
Hopes dashed right away Application Guard designed for enterprises much like other two security solutions requires at least Windows 10 Pro unlike other two solutions something didn't have test machine knew attempt going fail but wanted complete testing session write article because important lessons learned regardless so while shan't happy moment end piece you will not have just read another useless piece Internet fluff
Element somewhat shameless self promotion (not me) Application Guard uses Microsoft Edge underlying isolation engine (Hyper-V background) to that end offered through browser extension both Firefox and Chrome yes read right install extensions let you launch isolated tabs using Edge back in day had IETab Firefox well similar except underlying technology different focus security rather than compatibility
Started installing Firefox extension opened tab informed needed another step get actual Application Guard eh app from Store found incredibly badly orchestrated idea many reasons
One if not mistaken Windows Enterprise typically does not use Store two unfortunate demise Windows Phone whole store idea sort of pointless pointing [sic] people there doesn't really have value three need install App Guard component through Control Panel still more valuable useful than Settings four years later four back to Store will nudge prompt use online account but local setup or enterprise logon completely misses mark
At this point also happened test operational setup changed store WU settings with services disabled Windows couldn't install companion app turned services back on installed app turned them off easy peasy
However while doing setup app Firefox browsing blocked! Yup App Guard extension preventing Internet connectivity again bad design because forces users complete setup right away don't necessarily access Web search answers information while doing this
Work around disabling App Guard extension but really so many ways elegant ways could have been done instance offer everything one bundle rather than scatter setup across four different vectors maybe not feed setup piecemeal
Once step complete Firefox extension screen now showed another missing piece! one I could not fix Home edition and all that but then why wasn't this shown right away? this way feels whole effort there make me go Store install app
Really annoyed no reason have me install companion app if system Home cannot use technology but guess Microsoft repeating same mistakes all over had aggressive marketing GWX had forced updates now this not professional
After all if software intended serious people they will not monkeying about Store surely not using it pretty much dead platform woe my Lumia 950 right right! also pretty good chance using local account enterprise whole different set rules applies
Microsoft could have offered single MSI or EXE does everything add optional Windows features like Hyper-V and Application Guard configure system only leave extension configuration browser users that's it but apparently checkbox had to be checked somewhere read Store then reading fine print also mention diagnostic data sigh will they never learn?
And then actual configuration if get everything running
Security benefits
Reserve judgment until when do test Application Guard might want read ghacks article topic sheds wee more light than sad-face attempt but have bunch questions if made same kind sensible philosophy like EMET Exploit Mitigation then supreme product but then ... first Edge now uses same engine Chrome so concepts security sandboxing similar what's added benefit Application Guard this instance?
How Application Guard fit alongside Exploit Mitigation? mean have mitigations enabled various programs NOT for Edge because don't use does this mean exploit-hardened Firefox better security than non-hardened Edge regardless actual browser baseline security?
Speaking Firefox if use Adblock and/or Noscript good chance filtering lot noise garbage coincidentally associated security risks what additional benefits Application Guard introduce aren't covered above?
The most important question ...
Home edition users don't get this nice thing but then if really good based on what able to read no actual testing just yet then begs following question:
If Application Guard so important and effective why are Home edition users being left unprotected? And if Home edition users have adequate security already then is there real practical value to Application Guard?
สรุป
Application Guard sounds really cool thing but current implementation rough first Home edition users left out but okay get it setup clunky no reason piecemeal checkbox exercise browser extension screen if system not compatible Store step unnecessary and unnecessary regardless because not viable delivery method post-mobile Microsoft era simply does not align well typical Pro or Enterprise modes usage then practical questions security value Edge browser used isolated environment
Can't escape feeling this more than great security feature looks like attempt make people use Edge one way or another after roughly fifteen years steady market share decline Microsoft browsers overall container + isolation idea quite interesting fresh innovative my kind of fun but then does it solve real problem people doing silly things browsers? and then so-called drive-by exploits thing modern Firefox Chrome? don't know maybe
One day hope practical answers if Application Guard anywhere as robust flexible EMET and friends might be worthy tool browser engine notwithstanding for now skeptical first experience rather stilted oh well to be continued
Cheers.
