How to Create and Merge Windows Defender Application Control (WDAC) Policies Using PowerShell in Windows 11

Traditional endpoint protection architectures relying purely on signature-based anti-malware and heuristics are frequently bypassed by sophisticated zero-day exploits, fileless memory injections, and living-off-the-land binaries (LOLBins). Windows Defender Application Control (WDAC)—formerly known as Configurable Code Integrity—provides robust, kernel-enforced application whitelisting built directly into the Windows 11 operating system. Rather than attempting to block known malicious executables, WDAC enforces a zero-trust model: only cryptographically signed applications, drivers, and scripts explicitly authorised by policy are permitted to execute. Mastering the creation, scanning, and merging of WDAC policy files via Windows PowerShell enables systems engineers to establish resilient software execution guardrails across workstation fleets.

Understanding WDAC Multi-Policy Architecture

Starting with modern Windows 10 and Windows 11 builds, WDAC supports a flexible multi-policy architecture. In earlier iterations, systems administrators were constrained to a single monolithic policy file. Today, Windows 11 allows up to 32 active code integrity policies executing concurrently on an endpoint.

This multi-policy design categorises configurations into two functional layers:

• Base Policies: Establish foundational rules governing system-wide execution, such as requiring Microsoft-signed kernel drivers, trusting default Windows operating system binaries, and configuring policy enforcement modes (Audit vs Enforced).
• Supplemental Policies: Expand a base policy by appending additional trusted software certificates, specific file paths, or custom publisher identities without modifying the primary base policy XML structure. Supplemental policies cannot relax security controls established by their parent base policy; they can only grant supplementary trust.

Generating a Baseline Application Whitelist Policy Using New-CIPolicy

The native ConfigCI PowerShell module provides administrative cmdlets to scan directories, extract digital certificates, and compile XML-based Code Integrity definitions.

1. Click the Start button, type powershell, right-click Windows PowerShell, and select Run as administrator.
2. Verify that the ConfigCI module is available in your active session:

   Get-Command -Module ConfigCI

3. To create an initial base policy that scans a reference gold-standard directory (such as a directory containing approved enterprise applications in C:Program FilesEnterpriseApp), execute the New-CIPolicy cmdlet:

   New-CIPolicy -Level Publisher -FilePath "C:\WDAC\BasePolicy.xml" -ScanPath "C:\Program Files\EnterpriseApp" -UserPEs

In this command:

• -Level Publisher: Evaluates digital code-signing certificates, extracting the root certificate authority, publisher common name, and minimum binary version. This ensures that future application software updates signed by the same vendor run seamlessly without requiring policy resynthesisation.
• -UserPEs: Instructs the scanner to evaluate User-Mode Portable Executables (applications, dynamic link libraries, and active scripting hosts) in addition to kernel-mode drivers.
• -FilePath: Specifies the output destination for the resulting human-readable XML policy definition.

Configuring Audit Mode and Disabling Script Enforcement During Testing

Deploying a freshly minted WDAC policy directly into strict enforcement mode risks breaking legitimate business software and locking administrative tools. Always configure new policies in Audit Mode first to monitor application execution telemetry safely.

1. Open your elevated PowerShell console and inspect the rule options inside the generated policy XML:

   Set-RuleOption -FilePath "C:\WDAC\BasePolicy.xml" -Option 3

   Option 3 represents Audit Mode. When active, unauthorised binaries continue to execute normally, but the operating system logs code integrity violation events to Microsoft-Windows-CodeIntegrity/Operational (Event ID 3076).

2. To allow PowerShell scripts and batch files to run without Constrained Language Mode restrictions during initial baseline validation, enable the advanced boot options:

   Set-RuleOption -FilePath "C:\WDAC\BasePolicy.xml" -Option 11 -Delete

Scanning and Merging Supplemental Policies Using Merge-CIPolicy

When an organisation introduces a new software suite—such as specialised CAD tooling or internal developer utilities—administrators scan the new installation directory and merge its definitions directly into the primary base policy using Merge-CIPolicy.

1. Scan the newly installed secondary software suite to produce an isolated supplemental XML policy:

   New-CIPolicy -Level Hash -FilePath "C:\WDAC\CADSoftware.xml" -ScanPath "C:\Program Files\CADSuite" -UserPEs

   (Using -Level Hash is ideal for bespoke internal tools that lack formal code-signing certificates, binding execution rights strictly to SHA-256 binary checksums).

2. Next, merge the baseline enterprise policy and the CAD software policy into a unified master policy definition:

   Merge-CIPolicy -PolicyPaths "C:\WDAC\BasePolicy.xml", "C:\WDAC\CADSoftware.xml" -OutputFilePath "C:\WDAC\ConsolidatedPolicy.xml"

3. The Merge-CIPolicy cmdlet parses both XML trees, deduplicates identical signing keys, consolidates file rules, and exports a coherent single policy file ready for enterprise deployment.

Compiling and Deploying the Binary Code Integrity Policy (.cip)

Windows 11 cannot ingest raw XML files directly at the kernel layer. You must compile the validated XML document into a binary Code Integrity format (.cip).

1. Convert the consolidated XML policy using ConvertFrom-CIPolicy:

   ConvertFrom-CIPolicy "C:\WDAC\ConsolidatedPolicy.xml" "C:\WDAC\{PolicyGUID}.cip"

2. To deploy the policy to the local workstation for testing, copy the compiled .cip binary to the designated Windows Code Integrity schema repository:

   Copy-Item "C:\WDAC\{PolicyGUID}.cip" -Destination "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" -Force

3. Restart the workstation to load the policy into the Windows hypervisor and kernel subsystem.
4. Open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational to review audit telemetry and confirm policy activation.

Deploying programmatic WDAC policies via PowerShell establishes a bulletproof application execution boundary, neutralising ransomware outbreaks and mitigating lateral adversary movement across enterprise Windows 11 estates.