Antivirus blocks what it recognises as bad. Application control runs only what you said was good.
Microsoft describes the shift precisely: Windows moves from a place where all code runs unless your antivirus confidently predicts it is bad, to one where code runs only if your policy says so. It is the strongest endpoint control available and the one most organisations never attempt.
- Policy firstCode runs only if policy allows it
- Beyond appsScripts, MSI, batch files and PowerShell
- All editionsPro, Enterprise, Pro Education and Education
- 48 hoursBefore Smart App Control switches itself off
Eight things to understand before you start authoring policy.
The inversion at the centre of it
Windows changes from a place where all code runs unless your antivirus confidently predicts it is bad, to one where code runs only if your policy says so. That inversion is why it works against malware nobody has seen before, and why it needs a genuine inventory of what your business runs.
It reaches well beyond applications
Coverage extends to scripts and Microsoft installers, command line batch files, and interactive sessions of Windows PowerShell, which run in Constrained Language Mode. That PowerShell behaviour is significant in itself, because it closes one of the most used paths for living off the land attacks.
It sits alongside antivirus, not instead of it
Microsoft is explicit that application control is not a replacement for antivirus and that you should maintain an active antivirus solution alongside it. The two answer different questions: one asks whether this is known to be bad, the other asks whether it was ever permitted.
Two technologies, and the choice matters
Windows includes App Control for Business and AppLocker, and Microsoft frames the choice as depending on your specific scenarios and requirements. Some capabilities of App Control for Business are only available on specific Windows versions, so the estate shapes the answer.
Smart App Control as the starting point
From Windows 11 version 22H2, Smart App Control ensures only signed code runs, or code predicted safe by the cloud service. It is built entirely on App Control for Business, so its policy can be used as the basis for one of your own that also trusts your line of business applications.
The 48 hour behaviour on managed devices
Smart App Control starts in evaluation mode and switches off within 48 hours for enterprise managed devices unless the user turns it on first. That is worth knowing before anybody concludes it is enabled across the fleet, because on managed devices it usually is not.
The Intelligent Security Graph option
The reputation service Smart App Control uses is available in App Control for Business as the Intelligent Security Graph. Enabling it makes a policy considerably more workable in a diverse estate, at the cost of trusting a reputation judgement rather than an explicit rule.
Licensing that is unusually inclusive
Windows Pro, Enterprise, Pro Education and SE, and Education all support App Control for Business, and entitlements are granted by Windows Pro through to Enterprise E5 and Education A5. Unlike many controls at this level, licensing is rarely the reason an organisation cannot adopt it.
Enabling the reputation service puts Defender Antivirus into passive mode. That is intended.
Microsoft states this directly, and it prevents a support call that would otherwise be raised as a misconfiguration.
- When Smart App Control is turned on, or App Control is enabled with the Intelligent Security Graph, Microsoft Defender Antivirus is set to passive or hybrid mode on systems using a non-Microsoft antivirus for real-time protection. Microsoft describes this as expected behaviour, not a bug or a sign of misconfiguration.
- In that state Defender Antivirus handles reputation checks for App Control or Smart App Control while your chosen antivirus keeps real-time protection. Two products are present and neither is redundant, which is a different situation from the usual advice about running one antivirus.
- The second surprise is Smart App Control on managed devices. It starts in evaluation mode and switches off within 48 hours for enterprise managed devices unless the user turns it on first, so an organisation assuming it is protecting the fleet is usually mistaken.
- Turning it off deliberately is a registry change, VerifiedAndReputablePolicyState under the CI Policy key with 0 for off, 1 for enforce and 2 for evaluation, followed by running CiTool.exe with the refresh switch for the change to take effect. Doing that deliberately is better than leaving it ambiguous.
Four things that keep this project from being abandoned.
We run audit mode for longer than feels necessary
Audit logs what a policy would have blocked without blocking it. The purpose is to find the software nobody mentioned in the inventory: the quarterly finance macro, the engineering tool one team uses, the installer somebody runs from a share. All of them appear in audit and none appear in a survey.
We plan for scripts, not just applications
Coverage extends to scripts, Microsoft installers, batch files and interactive PowerShell sessions running in Constrained Language Mode. Organisations that scoped an inventory around installed applications and forgot the scripts get an unpleasant surprise on the day enforcement starts.
We decide the reputation question explicitly
Enabling the Intelligent Security Graph makes a policy far more workable in a diverse estate by trusting cloud reputation for code you have not explicitly allowed. That is a real security trade and it should be a recorded decision with reasoning rather than a checkbox somebody ticked.
We build the onboarding route before enforcing
Once code runs only if policy allows it, every new application needs a path into policy. Without that path, people find workarounds, and workarounds are how a strong control becomes a weak one. The process matters as much as the policy.
Four phases across roughly three to four months.
- 01Month 1
Understand what actually runs
Application inventory across the estate, including the things nobody counts: engineering tools, finance macros, scripts written by a department, and installers people run from a network share. The reach into scripts and batch files means the inventory has to reach there too.
- Application inventory across representative device groups
- Signed and unsigned software distinguished
- Script and macro usage identified
- Device groups defined by application profile
- 02Month 2
Author policy and run it in audit
A base policy authored, potentially starting from the Smart App Control example policy with the conditional Windows lockdown option removed, deployed in audit so it logs what it would have blocked without blocking anything.
- Base policy authored with a documented rationale
- Intelligent Security Graph decision recorded
- Audit deployment across pilot groups
- Would-have-blocked events collected and triaged
- 03Month 3
Refine until audit is quiet
Iterate on the policy until the audit log stops surfacing legitimate software. This is the phase organisations shorten and the one that determines whether enforcement is uneventful. A noisy audit log means an enforcement day full of blocked users.
- Policy refined against audit findings
- Line of business applications explicitly handled
- Exception process defined with owners
- Audit noise reduced to an agreed threshold
- 04Month 4
Enforce progressively and operate
Enforcement group by group rather than estate wide, with a rollback path and a support route. Then the ongoing part: new applications need a route into policy, or people will find a way around the control instead.
- Enforcement rolled out by device group
- Rollback path tested before broad enforcement
- New application onboarding process established
- Antivirus confirmed as still active alongside
Six situations where application control is proportionate.
An operator with fixed function workstations
Plant terminals, control room machines and kiosks run a small, stable set of software and should never run anything else. This is the easiest possible application control case, and it is frequently the one nobody has done because attention went to the office estate.
A regulated firm asked about executable control
Application control is cited by security organisations, including the Australian Signals Directorate, as one of the most effective ways to address executable file-based malware. Having it enforced on the systems that matter is a strong answer to a question that otherwise gets a hedged one.
A business that has had a ransomware scare
Ransomware relies on executing code the endpoint has never seen. A policy where code runs only if permitted addresses that directly, in a way that signature and behavioural detection cannot fully match. It is the control most likely to have changed the outcome.
A provider with clinical systems on fixed builds
Clinical and diagnostic workstations run validated software sets and change rarely, which is exactly the profile application control suits. It also protects builds that cannot be patched quickly, by preventing anything unauthorised from executing on them in the first place.
An organisation with a small privileged administrator group
Administrative workstations are the highest value targets and the smallest population, which makes them the ideal first deployment. A tightly scoped policy on a handful of machines delivers disproportionate benefit and provides the team with real experience before wider rollout.
A company reducing reliance on detection alone
Where the security strategy is entirely detection based, every improvement depends on recognising something as malicious. Application control adds a layer that does not require recognition, which is a genuinely different kind of defence rather than more of the same.
How UAE organisations control what executes.
| Feature | Application control enforced | Audit mode only | Antivirus and ASR rules |
|---|---|---|---|
Unknown code blocked | Yes | Logged only | Only if detected |
Unsigned software controlled | Yes | Visible | No |
Scripts and batch files covered | Yes | Visible | Partly via ASR |
PowerShell constrained | Constrained Language Mode | No | No |
Application inventory accurate | Necessarily | Yes | Frequently not |
Effort to maintain | Ongoing | Low | Low |
Risk of blocking legitimate work | Managed by audit phase | None | None |
Antivirus still required | Yes | Yes | Yes |
New software needs a process | Yes | No | No |
Effectiveness against novel malware | High | None | Variable |
Ten code paths and whether application control reaches them.
| Code path | Covered | |
|---|---|---|
| Executables | Yes, the core case | |
| DLLs and code in the system core | Yes, including kernel mode code | |
| Microsoft installers, MSI | Yes | |
| Scripts | Yes | |
| Command line batch files | Yes | |
| Interactive PowerShell sessions | Yes, constrained to Constrained Language Mode | |
| Unsigned line of business applications | Only if your policy allows them | |
| Code with good cloud reputation | Only if the Intelligent Security Graph is enabled | |
| Known malware | Blocked, and so is unknown code | |
| Antivirus role | Still required alongside |
Five steps, and the third is where the time goes.
- 1
Inventory what runs, including scripts
Applications, installers, scripts, batch files and macros across representative device groups, with signed and unsigned software distinguished. Coverage extends to all of those, so an inventory limited to installed programs is incomplete before it starts.
- 2
Choose the technology and the trust model
App Control for Business or AppLocker, and whether the Intelligent Security Graph is enabled to trust cloud reputation for code not explicitly allowed. Both decisions recorded with reasoning, since both shape everything that follows.
- 3
Author and deploy in audit mode
A base policy, optionally starting from the Smart App Control example policy with the conditional Windows lockdown option removed as Microsoft requires. Deployed in audit so it logs what it would have blocked while blocking nothing.
- 4
Refine until the audit log is quiet
Iterating on the policy against real would-have-blocked events until legitimate software stops appearing. This is the phase that gets shortened under pressure and the phase that determines whether enforcement causes an incident.
- 5
Enforce progressively and build the onboarding route
Group by group with a tested rollback, antivirus confirmed as still running alongside, and a defined path for getting new software into policy. Without that path the control degrades, because people route around what blocks their work.
What organisations ask about application control.
Fifteen questions that decide the shape of the project.
Estate
- How much of our software is signed?Unsigned needs explicit rules.
- Do departments run their own scripts?Scripts are in scope.
- Do we have engineering or specialist tools?Usually the hardest cases.
- What Windows editions do we run?All the main ones support it.
- What Windows versions?Some capabilities are version specific.
Design
- App Control or AppLocker?The choice depends on requirements.
- Will we enable the Intelligent Security Graph?It trades explicitness for workability.
- Are we starting from the Smart App Control policy?Remove the lockdown option first.
- How many device groups do we need?By application profile.
- Who owns the policy long term?It needs an owner.
Operations
- How long will we run audit mode?Longer than feels necessary.
- Who triages would-have-blocked events?A real workload.
- How does new software get approved?Or people route around it.
- Is antivirus staying in place?It should.
- Do we know the passive mode behaviour?Expected, not a fault.
List everything that runs on your administrative workstations.
That list is short, those machines are the highest value target you have, and they are the best possible place to start. Application control on them is a contained project with disproportionate benefit.
Related Services
Explore more solutions that work great with this service
Attack Surface Reduction Rules
Eighteen rules, audit first, then warn, then block
Defender for Endpoint
Business, Plan 1 or Plan 2, and what each actually gives you
Security Baselines
Why deploying one does not make you CIS compliant
Endpoint Privilege Management
Remove local admin rights without breaking the two apps that need it
Endpoint Security
Defender for Endpoint and Intune managed
Win32 App Packaging
Packaging, detection rules and deployment that works
Microsoft Defender
Advanced endpoint and email threat protection
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own