How to Configure Windows Defender Application Control (WDAC) in Windows 11 Using PowerShell

Traditional anti-virus engines rely on heuristic detection and signature blacklists, leaving systems vulnerable to zero-day malware and living-off-the-land binaries (LOLBins). Windows Defender Application Control (WDAC) delivers enterprise application whitelisting built directly into the Windows 11 kernel. By defining strict cryptographic trust baselines, WDAC blocks unauthorized software, unlicensed installers, and malicious scripts from executing. Authoring and deploying WDAC policies via PowerShell establishes impenetrable host defense.

Understanding WDAC Policy Architecture

WDAC enforces code integrity across multiple operational layers:

• Kernel-Level Enforcement: Code integrity policies are evaluated directly within the Windows kernel and protected by Hypervisor-Protected Code Integrity (HVCI), preventing even local administrators from bypassing restrictions.
• Audit Mode vs Enforced Mode: WDAC policies initially deploy in Audit Mode, logging policy violations to Windows Event Log (Event ID 3076) without blocking execution, allowing administrators to discover business software before switching to Enforced Mode.
• Multiple Policy Format: Windows 11 supports stacking multiple independent XML/binary policies simultaneously, allowing base operating system policies to be complemented by modular supplemental policies.

Generating a Golden Image Policy via PowerShell

To scan a clean reference workstation and generate a baseline code integrity policy:

# Define output paths
$xmlPath = "$HOME\Desktop\WDACBasePolicy.xml"
$binPath = "$HOME\Desktop\WDACBasePolicy.cip"

# Scan system drivers and applications to create policy
New-CIPolicy -Level Publisher -FilePath $xmlPath -ScanPath "C:\Program Files" -UserPEs

# Set policy into Audit Mode initially
Set-RuleOption -FilePath $xmlPath -Option 3 # Audit Mode

Write-Host "WDAC Policy successfully generated at $xmlPath" -ForegroundColor Green

This command catalogues digital certificates and publishers across installed software, authoring a comprehensive trust baseline.

Compiling and Deploying the Binary Policy

Windows enforces WDAC policies only when compiled into binary Code Integrity Policy (.cip) format:

1. Compile the XML policy document using PowerShell:

   ConvertFrom-CIPolicy -XmlFilePath $xmlPath -BinaryFilePath $binPath

2. Deploy the binary policy directly into the active system Code Integrity repository:

   Copy-Item -Path $binPath -Destination "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{PolicyGUID}.cip" -Force

3. Alternatively, on modern Windows 11 releases, refresh active policies immediately using:

   CiTool.exe -update-policies

Verifying Policy Status

Execute CiTool.exe -list-policies in PowerShell to confirm that your policy is active and operating in Audit or Enforce mode, guaranteeing endpoint immutability against untrusted code execution.