Application Control for Business: build base and supplemental policies

Application Control for Business—formerly Windows Defender Application Control—lets an organisation define which code is trusted to run on Windows. The safest enterprise pattern is a stable base policy that defines the common trust boundary, with narrowly scoped supplemental policies that add approved business applications without constantly rewriting the base.

Base and supplemental policy model

A maintainable enterprise pattern

Avoid broad path rules in user-writable locations. A path rule that trusts a location where standard users can write may allow untrusted code to inherit that trust. Prefer signer-based rules and use file attributes or hashes only where necessary.

Create a base policy

The App Control Wizard is the safest authoring interface for most teams because it exposes template choice, policy options and rule levels clearly. For repeatable engineering, use PowerShell and store the source XML, generated binary, evidence and change record together.

$Work = "C:\AppControl"
$Base = Join-Path $Work "Enterprise-Base.xml"

Copy-Item `
  "C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml" `
  $Base

# Create a unique multiple-policy ID and friendly name
Set-CIPolicyIdInfo -FilePath $Base `
  -PolicyName "Enterprise Windows Base - Audit" -ResetPolicyID

# Permit supplemental policies
Set-RuleOption -FilePath $Base -Option 17

# Optional: trust files installed by the approved managed installer
Set-RuleOption -FilePath $Base -Option 13

# Convert XML to a deployable policy file
ConvertFrom-CIPolicy -XmlFilePath $Base `
  -BinaryFilePath (Join-Path $Work "Enterprise-Base.cip")

The example starts from Microsoft’s audit template. Review every inherited option before deployment. In particular, decide whether script enforcement, ISG, managed installer, update-without-reboot and unsigned-policy behaviour match the enterprise threat model.

Managed Installer

Managed Installer can automatically trust applications installed by an approved software distribution system such as Intune or Configuration Manager. It improves manageability but does not replace the base rules required for Windows, boot components, kernel drivers and applications installed outside the managed path. Validate origin events and extended attributes before relying on it.

Create a supplemental policy

The base policy must allow supplementals. A supplemental policy must carry its own Policy ID and reference the exact Base Policy ID it expands.

$AppPath = "C:\Program Files\ApprovedLOBApp"
$Supp = "C:\AppControl\LOB-App-Supplemental.xml"
$Base = "C:\AppControl\Enterprise-Base.xml"

# Build allow rules from a trusted reference installation
New-CIPolicy -FilePath $Supp -ScanPath $AppPath `
  -Level Publisher -Fallback FilePublisher,Hash -UserPEs

# Convert the generated policy to a supplemental of the chosen base
Set-CIPolicyIdInfo -FilePath $Supp `
  -PolicyName "Approved LOB App - Supplemental" `
  -BasePolicyToSupplementPath $Base

ConvertFrom-CIPolicy -XmlFilePath $Supp `
  -BinaryFilePath "C:\AppControl\LOB-App-Supplemental.cip"

Rule-level guidance

Deploy through Microsoft Intune

1. Create the base policy under Endpoint security > App Control for Business.
2. Use a built-in policy only when its immutable configuration matches the design; otherwise upload the custom XML.
3. Assign the base to a small device ring and exclude emergency recovery devices.
4. Create the supplemental policy by uploading its XML and assign it to the same device population as the base, further narrowed where the application is required.
5. Validate policy application, active Policy IDs, Code Integrity events and application behaviour after restart.
6. Expand through technical pilot, business pilot and controlled production rings.

Intune provides strong assignment and deployment capabilities but does not replace central App Control event collection. Use Microsoft Defender for Endpoint Advanced Hunting or another event-forwarding platform to collect allowed, audited and blocked execution evidence.

Move from audit to enforce

All material policy changes should first run in audit mode. Build a representative observation window that includes boot, sign-in, VPN, Office, browsers, security agents, device drivers, scheduled tasks, application updates, repair and rollback.

Remove audit mode only after evidence review

$Enforced = "C:\AppControl\Enterprise-Base-Enforced.xml"
Copy-Item "C:\AppControl\Enterprise-Base.xml" $Enforced

# Option 3 is Audit Mode; removing it enables enforcement
Set-RuleOption -FilePath $Enforced -Option 3 -Delete

Set-CIPolicyIdInfo -FilePath $Enforced `
  -PolicyName "Enterprise Windows Base - Enforced"

ConvertFrom-CIPolicy -XmlFilePath $Enforced `
  -BinaryFilePath "C:\AppControl\Enterprise-Base-Enforced.cip"