How to Build Your First Windows Defender Application Control (WDAC) Policy

Both WDAC and AppLocker are Microsoft application control technologies. Defenders frequently ask which to use:

Microsoft's recommendation: Use WDAC where possible; AppLocker is supplementary for systems where WDAC cannot be deployed. They can run simultaneously.

When to use WDAC: Modern Windows 10/11 or Server 2016+ environments where you can invest in proper policy management. WDAC provides significantly better security but requires more upfront investment.

When to use AppLocker: Legacy environments (pre-Windows 10), when you need a quick partial control while building toward WDAC, or for user-mode script control on systems that cannot fully enforce WDAC.

Option 1: WDAC Wizard (Microsoft's GUI tool)

Download from: https://webapp-wdac-wizard.azurewebsites.net/

• Provides a guided policy creation workflow
• Generates signed or unsigned XML policies
• Supports policy supplements and merging

Option 2: PowerShell: create a baseline policy from Microsoft's recommended templates:

# Requires: Windows 10/11 or Server 2016+, ConfigCI module (built-in)

# Start with Microsoft's default Windows mode template
# This allows Windows components, WHQL-signed drivers, and Windows Store apps
$PolicyPath = "C:\WDAC\BasePolicy.xml"

# Get the path to the default policy templates
$TemplatePath = "C:\Windows\schemas\CodeIntegrity\ExamplePolicies"
Get-ChildItem $TemplatePath  # Lists available templates

# Use the DefaultWindows template as a starting point
Copy-Item "$TemplatePath\DefaultWindows_Audit.xml" $PolicyPath

# Set the policy to Audit mode (0 = audit, 1 = enforce)
Set-RuleOption -FilePath $PolicyPath -Option 3  # Audit mode

# Enable script enforcement (blocks unsigned PowerShell scripts)
Set-RuleOption -FilePath $PolicyPath -Option 11  # Disabled:Script Enforcement (remove this option to enforce)

# Remove Audit Mode for enforcement later: but don't do this yet
# Set-RuleOption -FilePath $PolicyPath -Option 3 -Delete

# Set the policy ID and name
[xml]$policyXml = Get-Content $PolicyPath
$policyXml.SiPolicy.PolicyID = "{$(New-Guid)}"
$policyXml.SiPolicy.FriendlyName = "Corporate WDAC Policy v1"
$policyXml.Save($PolicyPath)

# Convert XML to binary format for deployment
ConvertFrom-CIPolicy -XmlFilePath $PolicyPath -BinaryFilePath "C:\WDAC\BasePolicy.p7b"

# Deploy to the local machine for testing
Copy-Item "C:\WDAC\BasePolicy.p7b" \
  "$env:windir\System32\CodeIntegrity\CIPolicies\Active\{policy-guid-here}.cip"

# Restart required for policy to take effect
# Restart-Computer (do this when ready)

Run in audit mode for 1-2 weeks to capture all code that legitimately runs:

# Query Code Integrity audit events (Event ID 3076)
# These are files that WOULD be blocked in enforcement mode
Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' |
  Where-Object Id -eq 3076 |
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      TimeCreated = $_.TimeCreated
      FileName    = $xml.Event.EventData.Data | Where-Object Name -eq 'File Name' | Select-Object -ExpandProperty '#text'
      SHA256      = $xml.Event.EventData.Data | Where-Object Name -eq 'SHA256 Flat Hash' | Select-Object -ExpandProperty '#text'
      PolicyName  = $xml.Event.EventData.Data | Where-Object Name -eq 'Policy Name' | Select-Object -ExpandProperty '#text'
    }
  } | Export-Csv "C:\WDAC\audit-events.csv" -NoTypeInformation

# Review the blocked applications list
Import-Csv "C:\WDAC\audit-events.csv" | 
  Sort-Object FileName -Unique | 
  Select-Object FileName, SHA256 | 
  Format-Table -AutoSize

Create trust rules for legitimate software found in audit events:

# Option 1: Publisher rule (preferred: survives software updates)
# Extract signing certificate info from a file
$cert = (Get-AuthenticodeSignature -FilePath "C:\Program Files\SomeApp\app.exe").SignerCertificate
if ($cert) {
    # Create a publisher rule
    $rule = New-CIPolicyRule \
      -Level Publisher \
      -FilePath "C:\Program Files\SomeApp\app.exe"
    
    Add-CIPolicyRules -Policy $PolicyPath -Rules $rule
}

# Option 2: Generate rules from a reference machine
# (Best practice: run on a clean, fully configured machine)
New-CIPolicy \
  -Level Publisher \
  -Fallback Hash \
  -FilePath "C:\WDAC\ApplicationPolicy.xml" \
  -ScanPath "C:\Program Files" \
  -UserPEs  # Include user-mode executables

# Option 3: Generate rules from audit events directly
New-CIPolicy \
  -Level Publisher \
  -Fallback Hash \
  -FilePath "C:\WDAC\AuditDerivedPolicy.xml" \
  -Audit  # Scan audit event log to build policy from observed applications

# Merge application policy with base policy
Merge-CIPolicy \
  -PolicyPaths $PolicyPath, "C:\WDAC\ApplicationPolicy.xml" \
  -OutputFilePath "C:\WDAC\MergedPolicy.xml"

Microsoft maintains a list of known vulnerable drivers and LOLBins that WDAC should block: attackers abuse these to bypass application control. Include these in every WDAC policy.

# Download the recommended block list from Microsoft
# https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
# Save the XML as BlockList.xml

# Merge block rules into your policy
Merge-CIPolicy \
  -PolicyPaths "C:\WDAC\MergedPolicy.xml", "C:\WDAC\BlockList.xml" \
  -OutputFilePath "C:\WDAC\FinalPolicy.xml"

# The block list denies execution of:
# mshta.exe, wscript.exe, cscript.exe when used for policy bypass
# Known vulnerable signed drivers (LoLDrivers)
# Tools like PsExec, BGInfo, wmic used in specific bypass scenarios
# See: https://loldrivers.io/ for the full vulnerable driver list

Step 4: Switch to enforcement mode:

# Remove the Audit Mode option to enforce the policy
Set-RuleOption -FilePath "C:\WDAC\FinalPolicy.xml" -Option 3 -Delete

# Convert to binary
$policyGuid = ([xml](Get-Content "C:\WDAC\FinalPolicy.xml")).SiPolicy.PolicyID.Trim('{}')
ConvertFrom-CIPolicy \
  -XmlFilePath "C:\WDAC\FinalPolicy.xml" \
  -BinaryFilePath "C:\WDAC\{$policyGuid}.cip"

# Deploy via Intune (preferred for enterprise):
# Intune > Devices > Configuration Profiles > Create >
# Endpoint protection > Windows Defender Application Control
# Upload the .cip file as Custom OMA-URI:
# OMA-URI: ./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy
# Data type: Base64
# Value: (base64-encode the .cip file)

# Or deploy via Group Policy:
Copy-Item "C:\WDAC\{$policyGuid}.cip" \
  "\\fileserver\Netlogon\WDAC\{$policyGuid}.cip"
# GPO: Computer Configuration > Windows Settings > Security Settings >
# Application Control Policies > Windows Defender Application Control