Detections
Analytics
18.9.78.6 Ensure 'Configure Windows Defender Application Guard clipboard settings: Clipboard behavior setting' is set to 'Enabled: Enable clipboard operation from an isolated session to the host'
Information
This policy setting allows you to decide how the clipboard behaves while in Windows Defender Application Guard (WDAG).The recommended state for this setting is: Enabled: Enable clipboard operation from an isolated session to the host.
Note: WDAG requires a 64-bit version of Windows and a CPU supporting hardware-assisted CPU virtualization (Intel VT-x or AMD-V). This feature is not officially supported on virtual hardware, although it can work on VMs (especially for testing) provided that the hardware-assisted CPU virtualization feature is exposed by the host to the guest VM.
More information on system requirements for this feature can be found at this link:
System requirements for Windows Defender Application Guard (Windows 10) | Microsoft Docs
Rationale:
The primary purpose of Windows Defender Application Guard (WDAG) is to present a 'sandboxed container' for visiting untrusted websites. If the host clipboard is made available to WDAG, a compromised WDAG session will have access to its content, potentially exposing sensitive information to a malicious website or application. However, the risk is reduced if the WDAG clipboard is made accessible to the host, and indeed that functionality may often be necessary from an operational standpoint.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled: Enable clipboard operation from an isolated session to the hostComputer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings: Clipboard behavior setting
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template AppHVSI.admx/adml that is included with the Microsoft Windows 10 Release 1703 Administrative Templates (or newer).
Impact:
Windows Defender Application Guard (WDAG) sessions will not be able to access the host device's clipboard, however the host device will be able to access the WDAG session clipboard.
Default Value:
Disabled. (All clipboard functionality is turned off in Windows Defender Application Guard (WDAG).)
See Also
Item Details
References: CSCv6|13, CSCv7|13
Plugin: Windows
Control ID: 17a4744544a8ecfa8c915e0296323871f0b029833217a359244090665413d37a