How to Configure AppLocker Application Control Policies, Rule Enforcement, and Event Auditing in Windows 11

Architectural Foundation of AppLocker and the Application Identity Subsystem

Modern endpoint defence against malware execution, ransomware payloads, and unauthorized software deployment requires deterministic application whitelisting. In Windows 11 Enterprise and Education editions, AppLocker provides kernel-level application control enforced via the applocker.sys filter driver and the Application Identity Service (AppIDSvc).

Whenever a process attempts to execute a binary, launch a script interpreter, or invoke an installation package, the kernel intercepts the operation before allocating virtual memory pages. The Application Identity service inspects the file’s binary attributes—querying embedded Authenticode digital signatures, software publisher certificates, file hashes, and filesystem paths. If the binary fails to match an explicit Allow rule within the active AppLocker policy manifest, the kernel terminates process creation immediately, returning an access denied error and dispatching a structured security audit telemetry event.

Rule Collection	Monitored File Extensions	Kernel Interception Point	Primary Threat Mitigation
Executable Rules	.exe, .com	Process creation (NtCreateUserProcess)	Unapproved portable binaries, ransomware droppers
Windows Installer Rules	.msi, .msp, .mst	Windows Installer service (msiexec.exe)	Unauthorized application installations
Script Rules	.ps1, .bat, .cmd, .vbs, .js	Script hosts (PowerShell, WScript, CScript)	Living-off-the-land (LotL) malicious scripts
Packaged App Rules	.appx, .msix, AppxBundle	AppX Deployment Service (AppXSVC)	Sideloaded untrusted Microsoft Store packages
DLL Rules (Optional)	.dll, .ocx	Module load (LdrLoadDll)	DLL sideloading and DLL search-order hijacking

Enabling the Application Identity Service

AppLocker policies cannot execute unless the underlying AppIDSvc service is operational. If the service is stopped or set to Manual startup, Windows bypasses AppLocker policy enforcement entirely.

# Query current status of Application Identity Service
Get-Service -Name AppIDSvc

# Configure service to start automatically upon system boot
Set-Service -Name AppIDSvc -StartupType Automatic

# Start the service immediately
Start-Service -Name AppIDSvc

# Verify running state
Get-Service -Name AppIDSvc | Select-Object Name, Status, StartType

Configuring AppLocker Policies via Local Security Policy

Administrators configure AppLocker rulesets using the Local Security Policy console (secpol.msc) or Group Policy Management Console (GPMC).

Step 1: Access the AppLocker Policy Tree

1. Press Win + R, type secpol.msc, and press Enter.
2. Navigate through the left console tree:
   Security Settings > Application Control Policies > AppLocker.
3. Click Configure rule enforcement.
4. In the AppLocker Properties window, check the box labelled Configured under Executable rules.
5. In the drop-down menu, select Audit only (Mandatory initial baseline: test in audit mode to catalogue authorized corporate software before switching to Enforce rules).
6. Repeat this configuration for Windows Installer rules and Script rules. Click OK.

Step 2: Generate Default Baseline Rules (Prevent Admin Lockout)

CRITICAL WARNING: Never enforce an AppLocker policy without creating default rules. Omitting default rules locks all users—including Administrators—out of essential Windows binaries.

1. Expand the AppLocker node in the left pane.
2. Right-click Executable Rules and select Create Default Rules.
3. AppLocker automatically generates three baseline rules:
   • Allow members of the local Administrators group to run all applications.
   • Allow Everyone to run applications that are located in the Program Files folder (%PROGRAMFILES%\*).
   • Allow Everyone to run applications that are located in the Windows folder (%WINDIR%\*).
4. Right-click Script Rules and select Create Default Rules to establish script execution baselines.

Creating Hardened Publisher and File Hash Rules

While path-based rules (e.g., %WINDIR%\*) are convenient, attackers can bypass them by dropping malicious executables into user-writable directories inside the Windows folder (such as C:\Windows\Temp or C:\Windows\Tasks). Publisher Rules based on cryptographic digital signatures provide the gold standard in enterprise security.

Step 1: Creating a Software Publisher Rule

1. Right-click Executable Rules and select Create New Rule….
2. In the wizard, click Next. On the Permissions screen, leave action set to Allow and User set to Everyone.
3. On the Conditions screen, select Publisher (Recommended). Click Next.
4. Click Browse… and select a verified executable from the software vendor (e.g., C:\Program Files\Git\bin\git.exe).
5. AppLocker reads the binary’s digital certificate and extracts the publisher metadata:
   • Publisher: O=SOFTWARE FREEDOM CONSERVANCY, INC., ...
   • Product name: Git
   • File name: *
   • File version: * (or set minimum version threshold: 2.40.0.0 and above)
6. Click Create. Any executable signed with that vendor’s certificate is authorized regardless of its location on disk.

Managing and Exporting Policies via PowerShell

Enterprise administrators automate policy distribution and continuous deployment using the native AppLocker PowerShell module:

# 1. Audit active AppLocker policy effective on local system
Get-AppLockerPolicy -Effective -Xml > C:\Temp\EffectivePolicy.xml

# 2. Generate a new AppLocker policy XML by scanning an administrative staging folder
New-AppLockerPolicy -FileInformation (Get-ChildItem "D:\EnterpriseApps\" -Recurse) `
    -RuleType Publisher, Hash `
    -User Everyone `
    -Xml > C:\Temp\StagingAppsPolicy.xml

# 3. Merge staging rules into local policy without overwriting default rules
Set-AppLockerPolicy -XmlPolicy C:\Temp\StagingAppsPolicy.xml -Merge

# 4. Force immediate local Group Policy refresh
gpupdate /force

Auditing AppLocker Telemetry in Event Viewer

All policy evaluations, permitted executions, and enforcement blocks stream directly into a dedicated Windows Event Log catalogue.

1. Open Event Viewer (eventvwr.msc).
2. Navigate through the log tree:
   Applications and Services Logs > Microsoft > Windows > AppLocker.
3. Select the target log channel:
   • EXE and DLL: Tracks executable binaries.
   • MSI and Script: Tracks script interpreters and installation packages.
4. Inspect critical Event IDs:
   • Event ID 8002: Executable allowed to run.
   • Event ID 8003: Executable would have been blocked (Audit mode active).
   • Event ID 8004: Executable blocked from running (Enforce mode active).

Troubleshooting AppLocker Faults and Policy Bypasses

Observed Fault	Probable Root Cause	Technical Diagnostic Method	Remediation Protocol
Policies Completely Ignored / Unenforced	Application Identity Service (AppIDSvc) is stopped or set to Manual	Run Get-Service AppIDSvc	Set startup type to Automatic and start the service immediately
Administrator Locked Out of Workstation	Default rules omitted before switching from Audit to Enforce mode	Workstation displays “This app has been blocked by your system administrator”	Boot into Safe Mode or Windows RE; stop AppIDSvc or delete policy from Registry
Malware Executes from C:\Windows\Temp	Path rule allowing %WINDIR%\* contains user-writable subdirectories	Inspect ACLs on C:\Windows\Temp using Sysinternals accesschk.exe	Add explicit Deny path rules targeting writable folders or replace with Publisher rules
PowerShell Scripts Blocked Unexpectedly	Script Rules enforced; PowerShell runs in ConstrainedLanguage mode	Check $ExecutionContext.SessionState.LanguageMode in PowerShell	Create digital signature / publisher rules for trusted corporate .ps1 script files
Updated Software Fails to Launch	Rule configured using strict File Hash, which changed following software patch	Inspect Event ID 8004 in AppLocker event log	Transition from brittle File Hash rules to vendor Publisher / Certificate rules