How to Configure AppLocker Packaged App Rules in Windows 11 Using PowerShell

Modern endpoint management in Windows 11 requires securing traditional Win32 executables alongside modern Universal Windows Platform (UWP) and MSIX packaged applications distributed through the Microsoft Store or enterprise repositories. While standard AppLocker policies target classic .exe and .msi installers, unconstrained users can still download games, social media clients, or unauthorized productivity utilities from the Microsoft Store. AppLocker Packaged App (AppX) rules provide granular control over which packaged applications are permitted to execute on Windows 11 workstations.

Understanding AppLocker Packaged App Rules

Packaged applications—including AppX packages, modern MSIX containers, and modern Windows components—differ structurally from legacy Win32 binaries. They are digitally signed and contain package identity manifests defining:

• Publisher: The cryptographic certificate subject of the software developer (e.g., CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US).
• Package Name: The unique identity string of the application (e.g., Microsoft.WindowsCalculator).
• Package Version: The specific semantic versioning string (e.g., 11.2307.4.0).

AppLocker Packaged App rules leverage these signed manifests rather than file paths or hashes. This ensures that rules remain valid when applications update automatically while preventing users from running unapproved packaged applications.

Prerequisites and System Requirements

• Windows 11 Enterprise or Education edition (AppLocker enforcement is not supported on Windows 11 Pro).
• The Application Identity service (AppIDSvc) running on the local workstation.
• Elevated PowerShell prompt launched with local Administrator privileges.

Starting the Application Identity Service

AppLocker policies cannot evaluate or enforce process restrictions unless the Application Identity service is operational:

# Check current status
Get-Service -Name AppIDSvc

# Configure service to start automatically and launch it immediately
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

Creating Default Packaged App Rules via PowerShell

Before restricting any specific application, you must establish default baseline rules allowing verified system apps to function; otherwise, core Windows 11 interface components may be blocked:

# Generate standard default AppLocker rules for Packaged Apps
$AppLockerPolicy = Get-AppLockerPolicy -Effective -Xml

# Alternatively, create a default allow rule for all signed Microsoft Store apps
$RuleXml = @"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Appx" EnforcementMode="AuditOnly">
    <FilePublisherRule Id="a9f18e24-4f2b-426b-80a5-f852a39a8972" Name="All signed packaged apps" Description="Allows members of Everyone to run all signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
  </RuleCollection>
</AppLockerPolicy>
"@

# Export policy to a temporary XML definition
$RuleXml | Out-File -FilePath "$env:TEMP\AppLockerPackaged.xml" -Encoding utf8

# Apply policy in AuditOnly mode
Set-AppLockerPolicy -XmlPolicy "$env:TEMP\AppLockerPackaged.xml"

Creating Specific Package Denial Rules

To block a specific packaged application—for example, preventing standard users from launching consumer media applications or games—you can generate an explicit Deny rule based on the installed package metadata:

# 1. Query the exact package manifest details
$Package = Get-AppxPackage -Name "*WhatsApp*"

if ($Package) {
    # 2. Extract publisher certificate and package identity
    $Publisher = $Package.Publisher
    $PackageName = $Package.Name
    
    # 3. Generate AppLocker rule using New-AppLockerPolicy cmdlet
    Write-Host "Target Package: $PackageName"
    Write-Host "Publisher: $Publisher"
}

To deploy this rule into the active AppLocker policy, define a FilePublisherRule with Action="Deny" targeting the specific PublisherName and ProductName for non-administrative users (S-1-5-32-545 for Users).

Auditing Rule Enforcement in Windows Event Log

Always evaluate policies in AuditOnly mode prior to switching to full enforcement. When an audited packaged application is launched, AppLocker generates event logs under:

• Event ID 8023: Packaged app was allowed to run, but would be blocked if rules were enforced.
• Event ID 8024: Packaged app was allowed to run.
• Event ID 8025: Packaged app was blocked from executing (Enforce mode).

Query audit entries directly in PowerShell:

Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-AppLocker/Packaged app-Deployment"
} -MaxEvents 15 | Select-Object TimeCreated, Message | Format-List

Switching from Audit to Enforce Mode

Once audit logs confirm that no essential system components are impacted, update the policy XML attribute EnforcementMode="Enabled" and reapply using Set-AppLockerPolicy -XmlPolicy "$env:TEMP\AppLockerPackaged.xml".