implementing-application-whitelisting-with-applocker

Inventory approved applications with Get-AppLockerFileInformation, create default and publisher-based rules, then deploy via Group Policy in Audit mode for 2-4 weeks. Analyze AppLocker event logs (IDs 8003/8006), refine rules, and switch to Enforce mode in phases.

Publisher rules trust a digital signature and survive application updates, making them the preferred choice. Path rules allow execution from specific folders but fail if users can write there. Hash rules are most restrictive but break on every update.

AppLocker enforcement requires Windows 10/11 Enterprise or Education, or Windows Server 2016 and later. Policies can be configured on Pro but are not enforced. The Application Identity service (AppIDSvc) must also be running.

Common causes are rule collections left in AuditOnly mode, the AppIDSvc service stopped, or allow rules covering user-writable paths like %TEMP%. Verify with Get-AppLockerPolicy -Effective -Xml and confirm EnforcementMode is Enabled on all collections.

Yes, living-off-the-land binaries like mshta, regsvr32, msbuild, and installutil are Microsoft-signed and pass publisher rules. Add explicit Deny rules for these binaries in the Exe collection, applied to standard users, since Deny takes precedence over Allow.

Use Windows Defender Application Control when you need enforcement against local administrators, since AppLocker can be bypassed by admins by default. WDAC is also the modern successor for newer Windows deployments, while AppLocker remains simpler for standard GPO-based control.