WDAC (Windows Defender Application Control) is a Windows OS application control policy, and PowerShell complies with the system policy through added restrictions and language modes. This PR adds ETW event logging for calls PowerShell makes to WDAC in order to determine if the system is in lock down mode, and if a script file is allowed by the WDAC policy.
PR Summary
This PR adds new ETW events for WDAC calls.
PR Context
WDAC (Windows Defender Application Control) is a Windows OS application control policy, and PowerShell complies with the system policy through added restrictions and language modes. This PR adds ETW event logging for calls PowerShell makes to WDAC in order to determine if the system is in lock down mode, and if a script file is allowed by the WDAC policy.