The Importance of Application Whitelisting
Traditional antivirus software relies on identifying known bad files (blacklisting). However, in modern security environments, a more effective strategy is Application Whitelisting—blocking everything by default and only allowing specific, trusted programs to run. Windows 11 Enterprise and Education editions include AppLocker, a powerful feature that allows administrators to define exactly which executables, scripts, and installers users are permitted to execute.
Step 1: Ensure the Application Identity Service is Running
AppLocker rules will not enforce unless the “Application Identity” service is running on the client machine. Before configuring rules, ensure this service starts automatically.
Open the Group Policy Management Console (gpmc.msc), edit your target GPO, and navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Locate Application Identity, set it to “Automatic”, and apply.
Step 2: Navigate to AppLocker in Group Policy
In the same GPO, navigate to the AppLocker configuration area:Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker
Here you will see rule collections for Executables, Windows Installers, Scripts, and Packaged Apps (Microsoft Store apps).
Step 3: Generate Default Rules
Before you block anything, you must ensure that Windows core system files are allowed to run; otherwise, the computer will fail to boot. Right-click on Executable Rules and select Create Default Rules.
This will automatically create three rules:
1. Allow all users to run programs in the C:\Program Files and C:\Program Files (x86) folders.
2. Allow all users to run programs in the C:\Windows folder.
3. Allow the local Administrators group to run all files.
Step 4: Create a Custom Publisher Rule
To explicitly allow a custom application located outside of the default Windows directories, you can create a Publisher Rule (which relies on the digital signature of the software). Right-click Executable Rules and select Create New Rule…
Select Allow, assign it to a specific user group, and choose Publisher as the condition. Browse to the .exe file of the allowed application. AppLocker will extract the digital certificate details. You can slide the rule enforcement lever up or down to allow any version of the software from that specific publisher, or only the exact version you selected.
Step 5: Enforce the Rules
Finally, you must turn on enforcement. Click on the AppLocker node in the left pane. In the middle pane, click the Configure rule enforcement link.
Check the box under “Executable rules” and set the drop-down to Enforce rules. (Alternatively, you can choose “Audit only” if you just want to monitor what would be blocked in the Event Viewer before making it strict).
Click OK. Once the client machines run gpupdate /force, any executable not located in the allowed directories or explicitly whitelisted by a Publisher rule will be instantly blocked from running.