Skip to content

Policy Enforcement

WDAC Templates and Policy Enforcement

Windows Defender Application Control (WDAC) enables granular application control by enforcing a whitelist of trusted applications. Templates define the allowed applications and enforcement rules, while Group Policy (GPO) ensures these policies are applied consistently across systems. This section explains how to create and deploy WDAC policies using GPO.

Creating a WDAC Template

A WDAC template is a policy file that defines allowed applications, enforcement modes, and trusted boot requirements. Templates are created using the Windows Defender Application Control Policy Creation Tool (GUI) or command-line tools.

Step-by-Step Template Creation

  1. Open the Policy Creation Tool:

  2. Run WindowsDefenderApplicationControlPolicyCreationTool.exe from the Windows SDK or via PowerShell: 

    Start-Process -FilePath "C:\Program Files (x86)\Windows Kits\10\bin\<version>\x86\WindowsDefenderApplicationControlPolicyCreationTool.exe"

  3. Select Enforcement Mode:

  4. Choose Audit mode to test the policy without enforcing it, or Enforce mode for production.

  5. Define Trusted Applications:

  6. Add allowed applications by specifying paths, hashes, or publishers. For example:

    • Path-based rule: C:\Windows\System32\cmd.exe
    • Publisher rule: Microsoft Corporation

  7. Configure Trusted Boot:

  8. Ensure the system boots into a trusted state by enabling Trusted Boot and specifying a trusted certificate.

  9. Export the Template:

  10. Save the template as an .xml file (e.g., MyWDACPolicy.xml). This file will be deployed via GPO.

Deploying WDAC via GPO

Once the template is created, deploy it using GPO to enforce application control across managed systems.

GPO Configuration Steps

  1. Create a New GPO:
  2. Open the Group Policy Management Console (GPMC).

  3. Right-click the target OU, select Create a GPO, and name it (e.g., WDAC Application Control).

  4. Link the GPO to the OU:

  5. Ensure the GPO is linked to the organizational unit containing target systems.

  6. Configure WDAC Settings:

  7. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Control.

  8. Enable the following policies:

    • Enforce WDAC signed policy: Set to Enabled and specify the path to your .xml file.
    • Trusted boot: Enable this to ensure the system boots into a trusted state.
    • Audit mode: Disable this in production environments after testing.

  9. Deploy the Template:

  10. Use the Windows Defender Application Control tool to import the .xml file and apply it to the GPO.

Example: Enforcing a WDAC Policy via PowerShell

# Set the WDAC policy using the exported XML file
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope LocalMachine

Note: The Set-ExecutionPolicy cmdlet is for AppLocker. For WDAC, use the GPO settings to enforce the template.

Key Takeaways

  • Templates define allowed applications and enforcement rules, ensuring only trusted software runs.
  • GPO deployment ensures consistent policy application across systems.
  • Test in audit mode before enforcing to avoid unintended disruptions.
  • Trusted boot is critical to prevent tampering with the policy or boot process.
  • Always sign templates with a trusted certificate to avoid GPO enforcement failures.