Mastering App Control for Business#

Template: Smart App Control Policy#

The recommended starting point is the Smart App Control policy (SmartAppControl.xml), a built-in example policy shipped with Windows.

Important: Even though Smart App Control is disabled in enterprise environments, its policy template remains a useful and well-structured starting point for building managed policies.

Deployment Recommendation#

Always deploy policies in Audit Mode first. This allows you to observe what would be blocked without disrupting users. Only switch to Enforcement Mode after validating the policy impact.

flowchart LR
    A[Choose Template\nSmartAppControl.xml] --> B[Remove unsupported\ncode snippets]
    B --> C[Set Policy ID\nName & Version]
    C --> D[Configure\nSecurity Options]
    D --> E[Deploy in\nAudit Mode]
    E --> F[Review Event Log\nEvent 3034 — would-be blocks]
    F --> G{Rules OK?}
    G -->|No — tune rules| D
    G -->|Yes| H[Switch to\nEnforcement Mode]
    H --> I[Monitor Event Log\nEvent 3077 — actual blocks]
    style A fill:#1e3a5f,color:#93c5fd
    style E fill:#1c1400,color:#fbbf24
    style H fill:#14532d,color:#86efac
    style I fill:#14532d,color:#86efac

Approach#

IT team member Patrick’s strategy is to start slowly:

• Create one smart standalone policy for most users
• Expand with more restrictive rules in the future as confidence in the policy grows
• Avoid disruption to legitimate business applications during rollout

flowchart TD
    PROB[Problem: Employees install\nany app they want] --> RISK[Security Risk:\nMalware, unlicensed SW]
    RISK --> PLAN[Patrick's Plan:\nStart with Signed+Reputable policy]
    PLAN --> T1[Allow: Windows + Store + M365]
    PLAN --> T2[Allow: Publicly trusted signed code]
    PLAN --> T3[Allow: Good reputation via ISG]
    PLAN --> T4[Configure: Intune as Managed Installer]
    PLAN --> T5[Require: WHQL for drivers]
    T1 & T2 & T3 & T4 & T5 --> DEPLOY[Deploy in Audit Mode\nValidate — then Enforce]
    style PROB fill:#3b1515,color:#fca5a5
    style DEPLOY fill:#14532d,color:#86efac

Template Selected#

“Signed & Reputable” (SmartAppControl.xml) — this template allows only:

• Well-known signed applications, OR
• Unsigned applications with a good reputation as evaluated by the Intelligent Security Graph (ISG)

Step 1: Copy Template#

Copy the SmartAppControl.xml template from the Windows example policies directory to your working directory:

1
Source:  %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml

Step 2: Remove Unsupported Code Snippets#

The SmartAppControl.xml template contains XML blocks that are not supported in managed App Control for Business deployments. These must be removed before the policy can be used.

Remove this rule option:

1
<Rule>
2
  <Option>Enabled:Conditional Windows Lockdown Policy</Option>
3
</Rule>

Remove all of the following Settings blocks:

1
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="ShellSmartscreenSuppressed">
2
  <Value><Boolean>true</Boolean></Value>
3
</Setting>
4
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="BrowserSmartscreenSuppressed">
5
  <Value><Boolean>true</Boolean></Value>
6
</Setting>
7
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="ISGSmartscreenTrustSuppressed">
8
  <Value><Boolean>true</Boolean></Value>
9
</Setting>
10
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableUI">
11
  <Value><Boolean>true</Boolean></Value>
12
</Setting>
13
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownOfficeExtensions">
14
  <Value><Boolean>true</Boolean></Value>
15
</Setting>
16
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputablePerfMode">
17
  <Value><Boolean>true</Boolean></Value>
18
</Setting>
19
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableTrustMode">
20
  <Value><Boolean>true</Boolean></Value>
21
</Setting>
22
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownDangerousExtensionValidation">
23
  <Value><Boolean>true</Boolean></Value>
24
</Setting>
25
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownDangerousExtensionEnforcement">
26
  <Value><Boolean>true</Boolean></Value>
27
</Setting>
28
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="DisableMshtmlUmci">
29
  <Value><Boolean>true</Boolean></Value>
30
</Setting>
31
<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableAllowAntiMalware">
32
  <Value><Boolean>true</Boolean></Value>
33
</Setting>

flowchart LR
    RAW[SmartAppControl.xml\nOriginal Template] -->|Remove| C1[Conditional Windows\nLockdown Policy rule]
    RAW -->|Remove| C2[11× WindowsLockdown\nSettings Provider blocks]
    RAW -->|Keep| K1[All Signer rules]
    RAW -->|Keep| K2[EKU definitions]
    RAW -->|Keep| K3[Signing Scenarios]
    RAW -->|Keep| K4[ISG + Reputation rules]
    C1 & C2 & K1 & K2 & K3 & K4 --> CLEAN[Clean Policy\nReady for customisation]
    style C1 fill:#3b1515,color:#fca5a5
    style C2 fill:#3b1515,color:#fca5a5
    style CLEAN fill:#14532d,color:#86efac

Step 3: Set Basic Policy Information#

Use the following PowerShell commands to configure the policy identity:

1
# Set version
2
Set-CIPolicyVersion -FilePath .\SmartAppControl.xml -Version "1.0.0.0"
3

4
# Set policy name
5
Set-CIPolicyIdInfo -FilePath .\SmartAppControl.xml -PolicyName "MyBigBusinessBasePolicy"
6

7
# Generate and set new Policy ID
8
$guid = New-Guid
9
Set-CIPolicyIdInfo -FilePath .\SmartAppControl.xml -PolicyId $guid

Note: Policy version cannot be queried via PowerShell but is stored in the policy XML file and visible when you open it directly.

Step 4: Set Security Options#

The following rule options must be configured. Each option can be set via PowerShell or by editing the XML directly.

1
Set-RuleOption -FilePath .\SmartAppControl.xml -Option 2

1
<Rule><Option>Required:WHQL</Option></Rule>

1
Set-RuleOption -FilePath .\SmartAppControl.xml -Option 3

1
<Rule><Option>Enabled:Audit Mode</Option></Rule>

1
Set-RuleOption -FilePath .\SmartAppControl.xml -Option 6

1
<Rule><Option>Enabled:Unsigned System Integrity Policy</Option></Rule>

1
Set-RuleOption -FilePath .\SmartAppControl.xml -Option 13

1
<Rule><Option>Enabled:Managed Installer</Option></Rule>

1
Set-RuleOption -FilePath .\SmartAppControl.xml -Option 16

1
<Rule><Option>Enabled:Update Policy No Reboot</Option></Rule>

flowchart TD
    subgraph REQUIRED["Options Set for Starter Policy"]
        O2[Option 2\nRequired:WHQL\nAll drivers WHQL-certified]
        O3[Option 3\nAudit Mode\nTest before enforce]
        O6[Option 6\nUnsigned Policy\nNo signing required yet]
        O13[Option 13\nManaged Installer\nIntune apps auto-trusted]
        O16[Option 16\nNo Reboot on Update\nSeamless policy updates]
    end
    subgraph LATER["Add Later — Production Hardening"]
        O0[Option 0\nUMCI — User Mode\nEnable for full coverage]
        SIG[Remove Option 6\nSign the policy]
    end
    style REQUIRED fill:#162032,color:#58a6ff,stroke:#2563eb
    style LATER fill:#1c1400,color:#fbbf24,stroke:#d97706

Steps in the Wizard#

1. Select a similar template as the starting point
2. Select Multiple Policy Format + Base Policy (required if you plan to extend with supplemental policies)
3. Choose the template similar to SmartAppControl — “Signed & Reputable”
4. Set a meaningful filename — this is especially important if you are not using source or version control
5. Configure the following security options:

6. The Wizard provides an additional capability not available in the manual method — checkboxes to:
   • Merge with Recommended User Mode Block Rules — integrates known-bad user-mode signers as deny rules
   • Merge with Recommended Kernel Block Rules — integrates known-bad kernel-mode signers as deny rules

Both block rule merge options integrate Microsoft’s maintained deny lists directly into your policy, providing an additional layer of protection against known malicious signers.

flowchart TD
    WIZ[Open App Control\nPolicy Wizard] --> PC[Policy Creator]
    PC --> MPF[Multiple Policy Format\n+ Base Policy]
    MPF --> TMPL[Select Template:\nSigned & Reputable]
    TMPL --> NAME[Set Policy Name\n+ Output Directory]
    NAME --> OPT[Configure Options:\nISG + MI + WHQL\n+ No Reboot + Unsigned + Audit]
    OPT --> MERGE{Merge Block Rules?}
    MERGE -->|Yes — recommended| UMB[Merge User Mode\nBlock Rules]
    MERGE -->|Yes — recommended| KB[Merge Kernel\nBlock Rules]
    UMB & KB --> OUT[Output:\nPolicy XML + Binary .cip]
    style WIZ fill:#1e3a5f,color:#93c5fd
    style OUT fill:#14532d,color:#86efac

Deploy Locally with PowerShell (Testing Only)#

Warning: This method is for local testing and validation only. Use Intune for production deployments.

1
$PolicyBinary = "C:\Users\test.tester\Desktop\AC4B lightly managed devices\SmartAppControl.bin"
2
CiTool --update-policy $PolicyBinary

OS Version Compatibility:

Reference: Deploy App Control for Business policies using script | Microsoft Learn

Method 1: citool#

1
citool --list-policies

Output attributes explained:

Note: Several platform policies from Microsoft are applied by default on Windows 11 and will appear in this list alongside your custom policy.

Method 2: CodeIntegrity Folder#

Navigate to:

1
C:\Windows\System32\CodeIntegrity\

Method 3: Event Log#

Event Log Path: Microsoft-Windows-CodeIntegrity/Operational

Key Event IDs:

Filter events by specific policy using a PowerShell XML query:

1
$filterXml = @"
2
<QueryList>
3
  <Query Id="0" Path="Microsoft-Windows-CodeIntegrity/Operational">
4
    <Select Path="Microsoft-Windows-CodeIntegrity/Operational">
5
      *[System[Provider[@Name='Microsoft-Windows-CodeIntegrity']]]
6
      and
7
      *[EventData[Data[@Name='PolicyGUID']='{b6e0b4ef-9979-4124-80a1-5d5369cf8b85}']]
8
    </Select>
9
  </Query>
10
</QueryList>
11
"@
12
Get-WinEvent -FilterXml $filterXml

Replace the GUID in the query with the Policy ID assigned to your policy.

Reference: Understanding App Control event IDs | Microsoft Learn

flowchart TD
    DEPLOY[Policy Deployed] --> E3099
    E3099{Event 3099\nPolicy loaded?}
    E3099 -->|Yes| OK[Policy active\nCheck enforcement state]
    E3099 -->|No| FAIL[Policy not loaded\nCheck citool output]
    OK --> E3034
    E3034{Event 3034 found\nin audit mode?}
    E3034 -->|Yes| TUNE[Review blocked files\nAdd allow rules if legitimate]
    E3034 -->|No| CLEAN[No issues\nReady to enforce]
    TUNE --> ITERATE[Tune rules\nRe-deploy]
    CLEAN --> ENFORCE[Switch to\nEnforcement Mode]
    ITERATE --> E3034
    ENFORCE --> E3077{Event 3077\nActual blocks?}
    E3077 -->|Expected| GOOD[Working as intended]
    E3077 -->|Unexpected| REVIEW[Review + add\nexception rules]
    style OK fill:#14532d,color:#86efac
    style CLEAN fill:#14532d,color:#86efac
    style GOOD fill:#14532d,color:#86efac
    style FAIL fill:#3b1515,color:#fca5a5

Next Step: Enable Enforcement Mode#

After validating all rules and confirming acceptable policy impact in audit mode, switch the policy to Enforcement Mode by removing Option 3 (Audit Mode) and redeploying.