How to Configure Windows Defender Application Control (WDAC) Policies in Windows 11

Traditional signature-based antivirus software relies on identifying known malware signatures. However, zero-day exploits, fileless memory attacks, and ransomware frequently bypass traditional defenses. Windows Defender Application Control (WDAC)—formerly known as Configurable Code Integrity—provides zero-trust application whitelisting enforced at the Windows 11 kernel hypervisor layer. By establishing a cryptographically verified list of trusted publishers, binaries, and scripts, WDAC blocks unauthorized executables from launching even if an attacker possesses local administrative rights.

WDAC Architecture vs Legacy AppLocker

While AppLocker operates at user-mode layers and can be bypassed by unmanaged DLL injection or administrative override, WDAC rules are integrated directly into the Windows Code Integrity subsystem and enforced in kernel memory:

Security Capability	Legacy AppLocker	Windows 11 WDAC
Enforcement Layer	User-Mode DLL driver	Kernel-Mode Code Integrity (CI)
Virtualization Protection	None	Hypervisor-Protected Code Integrity (HVCI)
Bypass Resistance	Vulnerable to admin tampers	Immutable even to local Administrator / SYSTEM
Multi-Policy Stacking	Single GPO rule set	Supports up to 32 stacked supplemental policies

Creating a Baseline WDAC Policy with PowerShell

Windows 11 includes the native ConfigCI PowerShell module. Launch an elevated PowerShell console to generate a baseline policy from a clean reference computer:

1. Define the destination path for the raw XML policy:

   $PolicyPath = "$env:USERPROFILEDesktopWDAC_Baseline.xml"

2. Generate a policy based on the default Windows driver and operating system files:

   New-CIPolicy -Level Publisher -FilePath $PolicyPath -UserPEs -ScanPath "C:Windows"

3. This scan audits all binaries, catalog files, and digital signatures in C:Windows, producing a structured XML policy document.

Configuring Audit Mode to Prevent Operational Outages

Never deploy a newly created WDAC policy in enforcement mode immediately, as doing so can prevent essential business tools from starting. Always configure the policy in Audit Mode first:

# Enable Audit Mode rule option (Rule Option 3)
Set-RuleOption -FilePath $PolicyPath -Option 3

# Allow unsigned scripts during audit evaluation (Rule Option 0)
Set-RuleOption -FilePath $PolicyPath -Option 0

Converting XML to Binary and Deploying the Policy

The Windows Code Integrity driver requires policies to be compiled from human-readable XML into binary CIP (Code Integrity Policy) format:

# Compile XML to binary CIP format
ConvertFrom-CIPolicy $PolicyPath "$env:USERPROFILEDesktop{PolicyGUID}.cip"

To deploy the policy to your local machine, copy the compiled .cip file into the secure Windows system directory:

# Copy policy to CodeIntegrity directory (requires Admin)
Copy-Item "$env:USERPROFILEDesktop{PolicyGUID}.cip" -Destination "C:WindowsSystem32CodeIntegrityCiPoliciesActive"

Restart the computer to activate kernel-level evaluation.

Auditing Blocked Executables in Event Viewer

While running in Audit Mode, Windows logs any execution that would have been blocked under full enforcement without interrupting the user:

1. Open Event Viewer and navigate to:
   Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
2. Look for Event ID 3076 (Code Integrity determined that a file would have been blocked had the policy been enforced).
3. Inspect the logged event details to identify legitimate line-of-business applications requiring supplemental publisher whitelisting.

Once all corporate software publishers are captured and added via supplemental policies, remove Rule Option 3 (Audit Mode) and recompile the binary. Windows 11 will enforce zero-trust application execution with kernel-level resiliency.