How to Configure Windows Defender Application Control Simulation Mode Using PowerShell

Windows Defender Application Control (WDAC)—formerly known as Configurable Code Integrity—provides robust protection against malware, unauthorized scripts, and zero-day execution by enforcing application whitelisting at the Windows kernel level. However, deploying an enforcement policy immediately can disrupt critical business operations by inadvertently blocking legitimate software. To prevent downtime, administrators can configure WDAC in Audit Mode (simulation mode) using PowerShell to log policy triggers safely without blocking applications.

Why Audit Mode is Essential Before Enforcement

When WDAC operates in Audit Mode, the code integrity subsystem checks every binary, dynamic link library (DLL), driver, and PowerShell script against your defined XML policy rules. If an executable violates the policy, Windows allows the application to run normally while generating a detailed event log entry (Event ID 3076). This allows security teams to build a comprehensive inventory of line-of-business applications and refine trust rules before switching to strict enforcement mode.

Generating a Base WDAC Policy Using PowerShell

Follow these steps to create a baseline WDAC policy from a clean reference workstation:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Create a working directory for your policies:

   New-Item -Path "C:\WDAC" -ItemType Directory -Force
   Set-Location -Path "C:\WDAC"

3. Generate a base policy scanning Windows system binaries using the New-CIPolicy cmdlet:

   New-CIPolicy -FilePath "C:\WDAC\BasePolicy.xml" -Level Publisher -Fallback Hash -UserPEs -ScanPath "C:\Program Files"

Configuring the Policy for Audit (Simulation) Mode

By default, newly generated policies often enforce restrictions unless explicitly set to Audit Mode. Use Set-RuleOption to configure simulation behaviour:

# Enable Audit Mode (Option 3):
Set-RuleOption -FilePath "C:\WDAC\BasePolicy.xml" -Option 3

# Optional: Enable Advanced Boot Options Menu (Option 0):
Set-RuleOption -FilePath "C:\WDAC\BasePolicy.xml" -Option 0

To verify that Option 3 (Audit Mode) is active, inspect the XML file:

Select-String -Path "C:\WDAC\BasePolicy.xml" -Pattern "Enabled:Audit Mode"

Converting and Deploying the Binary Policy

The Windows kernel does not execute XML files directly; the policy must be compiled into a binary format (.cip):

1. Convert the XML policy to binary using ConvertFrom-CIPolicy:

   ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\BasePolicy.xml" -BinaryFilePath "C:\WDAC\SiPolicy.p7b"

2. Deploy the policy by copying it to the system Code Integrity directory:

   Copy-Item -Path "C:\WDAC\SiPolicy.p7b" -Destination "C:\Windows\System32\CodeIntegrity\SiPolicy.p7b" -Force

3. Restart the workstation to activate kernel code integrity checking in Audit Mode.

Reviewing WDAC Simulation Events in Event Viewer

Once deployed, monitor application triggers through the dedicated Code Integrity event channel:

1. Press Win + X and select Event Viewer.
2. Navigate to: Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
3. Filter for Event ID 3076 (audit failure). Each event details the file name, publisher certificate, SHA-256 hash, and calling process that would have been blocked under enforcement mode.

Simulating WDAC policies empowers administrators to audit enterprise software landscapes thoroughly, ensuring seamless security hardening without disrupting daily operations.