Deploy Application Control with AppLocker or WDAC

Antivirus and EDR answer the question "is this file malicious?" — application control flips the question to "is this file allowed to run at all?" Instead of chasing an infinite list of bad software, you define the finite list of good software and block everything else by default. Deployed properly, allowlisting stops commodity malware, unsigned tooling, and most living-off-the-land tradecraft before any behavioral detection is even needed. It is consistently ranked among the most effective endpoint mitigations — including the top spot in frameworks like the ACSC Essential Eight — precisely because it does not depend on recognizing the threat.

AppLocker vs WDAC — which one, when

• AppLocker is the older, simpler technology: rules based on publisher, path, or file hash, applied per user or group, managed comfortably through GPO. It is easier to operate but runs in user mode — an admin-level attacker can tamper with it, and Microsoft no longer actively develops it.
• WDAC (now branded App Control for Business) enforces policy in the kernel, covers drivers as well as applications, supports signed and tamper-resistant policies, and is where all of Microsoft's investment goes. It is the stronger control — and the steeper learning curve, since policies are machine-wide XML documents rather than a friendly GPO editor.
• A pragmatic pattern: WDAC as the primary enforcement layer with broad trust rules (signed by known vendors, deployed by your management tooling), and AppLocker layered on top for per-user exceptions and quick operational adjustments.
• Check your licensing and OS mix first: WDAC works on all Windows 10/11 editions, while AppLocker enforcement requires Enterprise/Education SKUs.

Deployment path — audit first, always

• Start with a baseline policy built from a golden image or Microsoft's example policies (DefaultWindows or AllowMicrosoft templates for WDAC), then add rules for your business applications.
• Deploy in audit mode and collect events for several weeks: AppLocker logs to Applications and Services Logs > Microsoft > Windows > AppLocker (Event IDs 8003/8006 for would-be blocks), WDAC to the CodeIntegrity log (Event ID 3076).
• Prefer publisher/signature rules over hash rules wherever possible — hash rules break on every application update and create permanent maintenance debt. Path rules are acceptable only for admin-protected locations.
• Include the managed-installer or trusted-deployment pattern: software deployed by Intune/MECM is automatically trusted, which removes most of the ongoing rule churn.
• Enforce in rings: IT first, then a pilot department, then the fleet. Keep a fast, well-communicated exception process — the program dies politically if a blocked business app takes a week to approve.

Do not forget scripts and LOLBins

• Application control that only covers .exe files misses half the threat model. Enable rule collections for scripts (PowerShell, VBScript, JScript), MSI packages, and DLLs where performance allows.
• WDAC enforcement automatically puts PowerShell into Constrained Language Mode for unapproved scripts — a significant hardening win on its own.
• Block or restrict the well-known living-off-the-land binaries (mshta, regsvr32, rundll32 abuse patterns, etc.) using Microsoft's recommended block rules as a supplementary policy.

Operational reality

• Budget for ongoing ownership: someone must review audit events, process exceptions, and update rules as software changes. Allowlisting is a program, not a project.
• Developers and other high-churn users may need dedicated, looser policies or separate VMs — one policy rarely fits the whole organization.
• Measure success by both blocked executions and exception turnaround time; the second number determines whether the business tolerates the first.

This is a Third-tier control for a reason: it demands mature software deployment and inventory practices. But once running, it changes the defensive equation entirely — the attacker's payload no longer merely needs to evade detection, it needs to be on your list.