Signing an audit App Control for Business (WDAC) Policy Doesn't Log Events?

[The Cyber Warden]

Hello,We have several App Control for Business policies deployed on our fleet of machines, several of them are signed and enforced.We had one policy in audit mode (unsigned), and the Code Integrity logs for this policy came in just fine. No issues for months.We decided to sign it and leave it in audit mode -- however, signing the audit policy caused events to not be logged anymore.We've verified that the policy is "signed","authorized", and "enforced" using the CiTool.Can someone confirm that signed, audit, app control policies should be logging things?Thanks!

Continue reading...