How to Clear the Windows AppLocker Cache using PowerShell

Understanding AppLocker

In a tightly controlled enterprise environment, preventing users from running unauthorized software is critical. Rather than relying solely on antivirus to catch malware after it executes, administrators use AppLocker (Application Identity Service). AppLocker acts as a strict whitelist; if an executable (like malware.exe or an unauthorized copy of games.exe) is not explicitly permitted by a Group Policy rule, the Windows kernel outright refuses to launch it.

However, when an administrator updates the AppLocker rules via Active Directory (e.g., finally granting permission to run a new version of AutoCAD), users often complain they are still blocked. This occurs because the local Windows workstation caches the AppLocker policy to ensure performance. If the cache does not update immediately, the computer remains locked down based on the old ruleset. To resolve this instantly, you must forcefully clear the AppLocker cache.

Locating the Cache Directory

The AppLocker rules are compiled and stored deeply within the system32 directory, securely owned by the SYSTEM account. The compiled policy files are located at:

C:\Windows\System32\AppLocker

Inside this folder, you will find files ending in .applocker (e.g., Exe.applocker, Msi.applocker).

Clearing the Cache using PowerShell

Because these files dictate core operating system security, you cannot simply highlight them in File Explorer and press Delete. You must use PowerShell with elevated Administrator privileges to stop the security service, delete the files, and restart the service.

Open an elevated PowerShell window and execute the following script:

# Stop the Application Identity Service
Stop-Service -Name AppIDSvc -Force

# Delete the cached policy files
Remove-Item -Path "C:\Windows\System32\AppLocker\*.*" -Force

# Start the service again
Start-Service -Name AppIDSvc

This script forcefully drops the active security locks, deletes the stale rules, and restarts the engine. Note: During the second the service is stopped, new applications cannot be launched.

Forcing a Policy Refresh

Deleting the cache simply leaves the computer with no AppLocker rules at all. If you stop here, the system defaults to “allow everything.” You must now force the computer to pull the brand-new, updated ruleset from the Domain Controller.

Execute the standard Group Policy update command:

gpupdate /force

When the policy update completes, the Application Identity Service will instantly rebuild the C:\Windows\System32\AppLocker directory using the fresh, accurate rules from the server. The user can now launch the newly authorized application without encountering the “This app has been blocked by your system administrator” error.