WDAC Audit Mode Flooding CodeIntegrity Logs

Welcome to Microsoft Q&A!

Thank you for providing the additional details.

When WDAC is running in Audit Mode, Event ID 3076 is logged whenever an application, DLL, script, or driver would have been blocked if the policy were enforced. Seeing a very large number of 3076 events typically indicates that the policy is repeatedly auditing the same unsigned or untrusted files. While Audit Mode is valuable for policy tuning, excessive audit events can increase log volume and may affect system performance.

To help reduce the number of events and improve performance, consider the following recommendations:

1.Identify the most frequent 3076 events and determine which files are generating them.

2.Consolidate your allow rules whenever possible. For example:

• Prefer Publisher rules instead of individual hash rules.
• Use FilePublisher rules rather than creating rules for each file separately.
• Consider Supplemental Policies instead of adding many individual exceptions.

3.Sign internally developed applications and scripts and ensure third-party components are signed by trusted publishers. Microsoft recommends addressing recurring audit events through code signing or catalog signing whenever possible.

4.Review and incorporate legitimate audit findings into your WDAC policy, then redeploy the updated policy. Audit Mode is intended to help refine policies before moving to enforcement.

5.If you collect WDAC telemetry centrally, consider filtering Event ID 3076 entries within your monitoring solution instead of relying on local event logs for long-term analysis.

6.Ensure that you are using the latest WDAC tooling and policy configuration guidance, as newer releases may help reduce known sources of audit noise.

A few additional points that may be helpful:

• Event ID 3076 indicates that an application would have been blocked if the policy were enforced.
• Event ID 3077 indicates that an application was blocked by an enforced WDAC policy.
• WDAC does not provide a policy setting to suppress specific 3076 audit events while continuing to audit those files. The recommended approach is to address the underlying cause by allowing trusted files through appropriate policy rules or codesigning them.
• If DLL loading is responsible for most of the events, using broader publisher-based rules can be more efficient than maintaining many individual file exceptions.

In general, I recommend the following workflow:

Audit Mode → Review 3076 Events → Refine Policy → Eliminate Recurring Audit Hits → Move to Enforced Mode

This approach helps reduce Code Integrity log growth while resulting in a cleaner and more maintainable WDAC policy

Reference: Understanding App Control event IDs | Microsoft Learn

If you find this information helpful, please click Accept Answer. 

Thank you for using Microsoft Q&A.