Mastering App Control for Business#

Code Signing Certificate#

A valid code signing certificate is required to sign ACfB policies. The following options are available:

System Requirements#

• All devices on which signed policies will be applied must have UEFI and Secure Boot enabled.

Tooling#

SignTool.exe is required to sign policy binaries. It is part of the Windows Software Development Kit (SDK).

After SDK installation, SignTool.exe is located in the \Bin folder. Example path:

1
C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe

Create Self-Signed Certificate (Testing Only)#

The following PowerShell script creates a self-signed code signing certificate and exports it in both PFX and CRT formats:

1
# Parameters
2
$certName = "CodeSigningCertTest"
3
$certPath = "Cert:\CurrentUser\My"
4
$validYears = 1
5

6
# Create self-signed certificate
7
$cert = New-SelfSignedCertificate `
8
    -Subject "CN=$certName" `
9
    -Type CodeSigningCert `
10
    -CertStoreLocation $certPath `
11
    -KeyUsage DigitalSignature `
12
    -KeyExportPolicy Exportable `
13
    -NotAfter (Get-Date).AddYears($validYears) `
14
    -HashAlgorithm "SHA256" `
15
    -KeyLength 4096
16

17
# Export as PFX (includes private key)
18
$pfxPath = "$env:USERPROFILE\Desktop\$certName.pfx"
19
$certPassword = Read-Host -Prompt "Enter a password for the PFX-Container" -AsSecureString
20
Export-PfxCertificate `
21
    -Cert $cert `
22
    -FilePath $pfxPath `
23
    -Password $certPassword
24

25
# Export certificate as CRT (DER format — public key only)
26
$crtPath = "$env:USERPROFILE\Desktop\$certName.crt"
27
Export-Certificate `
28
    -Cert $cert `
29
    -FilePath $crtPath
30

31
Write-Host "Certificate was created and exported with private key to: $pfxPath"
32
Write-Host "Certificate was exported to: $crtPath"

flowchart TD
    NEED[Need Code Signing\nCertificate] --> OPT1
    OPT1{Environment?}
    OPT1 -->|Enterprise with PKI| INT[Internal Enterprise CA\nBest control + cost]
    OPT1 -->|No internal PKI| PUR[Purchase from\nMicrosoft Trusted Root\nProgram participant]
    OPT1 -->|Lab / Testing only| SELF[Self-signed certificate\nNew-SelfSignedCertificate]
    INT --> REQ[Ensure: SHA256\n4096-bit key\nCode Signing EKU]
    PUR --> REQ
    SELF --> LAB[Testing only\nNever use in production]
    REQ --> STORE[Export PFX + CRT\nStore securely — HSM recommended]
    STORE --> TRUST[Deploy CRT to all devices\nTrusted Publisher — Machine Store]
    style INT fill:#14532d,color:#86efac
    style PUR fill:#1e3a5f,color:#93c5fd
    style SELF fill:#1c1400,color:#fbbf24
    style LAB fill:#3b1515,color:#fca5a5

Important Certificate Security Notes#

• Export both the certificate (.crt) and PFX container (.pfx) and store them in a secure location (e.g., a hardware security module).
• The PFX container contains the public and private key. Anyone with access to this file can disable deployed signed ACfB policies.
• All devices on which signed policies are applied must trust the code signing certificate (Trusted Publisher — machine certificate store).
• Rename the certificate’s app registration to conform to your organization’s naming convention.

Preparation — PowerShell#

Before signing, enable the following rule options to ensure the system remains recoverable if a policy issue is encountered after signing:

1
# Option 9: Enabled:Advanced Boot Options Menu (F8 menu)
2
Set-RuleOption -FilePath C:\temp\MyBigBusiness_v10.0.5.1.xml -Option 9
3

4
# Option 10: Enabled:Boot Audit on Failure
5
Set-RuleOption -FilePath C:\temp\MyBigBusiness_v10.0.5.1.xml -Option 10

Warning: If Options 9 and 10 are not enabled and a policy failure occurs, the system may be left in an unbootable state.

Remove the unsigned policy option (Option 6) to enforce the signing requirement:

1
Set-RuleOption -FilePath C:\temp\MyBigBusiness_v10.0.5.1.xml -Option 6 -Delete

Add an UpdatePolicySigner rule referencing the code signing certificate:

1
# Note: Omit -Supplemental if your policy does not allow supplemental policies
2
Add-SignerRule -FilePath C:\temp\MyBigBusinessFromWizard_v10.0.5.1.xml -CertificatePath $env:Userprofile\Desktop\CodeSigningCertTest.crt -Update -Supplemental

This creates an <UpdatePolicySigner> entry in the policy XML that references the signing certificate. Only a party holding the corresponding private key will be able to update or replace this signed policy.

Reference: Add-SignerRule (ConfigCI) | Microsoft Learn

Increment the policy version and rename the file to reflect the new version:

1
Set-CIPolicyVersion -FilePath C:\temp\MyBigBusiness_v10.0.5.1.xml -Version 10.0.5.2
2
Rename-Item -Path C:\temp\MyBigBusiness_v10.0.5.1.xml -NewName C:\temp\MyBigBusiness_v10.0.5.2.xml

sequenceDiagram
    participant Admin
    participant PS as PowerShell ConfigCI
    participant XML as Policy XML
    participant CERT as Certificate Store

    Admin->>PS: Set-RuleOption -Option 9 (F8 boot menu)
    PS->>XML: Add Enabled:Advanced Boot Options Menu
    Admin->>PS: Set-RuleOption -Option 10 (Boot audit on fail)
    PS->>XML: Add Enabled:Boot Audit on Failure
    Admin->>PS: Set-RuleOption -Option 6 -Delete (Remove unsigned)
    PS->>XML: Remove Enabled:Unsigned System Integrity Policy
    Note over XML: Policy now REQUIRES a signature
    Admin->>CERT: Locate CodeSigningCertTest.crt
    Admin->>PS: Add-SignerRule -CertificatePath cert.crt -Update -Supplemental
    PS->>XML: Add UpdatePolicySigner entry
    Admin->>PS: Set-CIPolicyVersion -Version 10.0.5.2
    PS->>XML: Increment VersionEx

Preparation — App Control Wizard#

The same preparation steps can be performed through the App Control Policy Wizard UI. After completing the wizard, add the signer rule via command line:

1
# Note: Omit -Supplemental if your policy does not allow supplemental policies
2
Add-SignerRule -FilePath C:\temp\MyBigBusinessFromWizard_v10.0.5.2.xml -CertificatePath $env:Userprofile\Desktop\CodeSigningCertTest.crt -Update -Supplemental

SignTool Parameters Explained#

After signing, a new file with a .p7 extension appears in the working directory. Rename this file so it matches the GUID-based .cip naming convention:

1
{fe1dbc91-5bb7-45f5-9164-299bdff9694d}.cip

Verify the Signed Policy#

Use certutil.exe to inspect the ASN.1 structure of the signed policy binary:

1
# Using certutil
2
certutil.exe -asn "C:\temp\done{fe1dbc91-5bb7-45f5-9164-299bdff9694d}.cip.p7"

Use PowerShell to extract additional certificate details from the signed binary:

1
# Using PowerShell for additional signature info
2
$CIPolicyBin = "C:\temp\done\{fe1dbc91-5bb7-45f5-9164-299bdff9694d}.cip"
3
Add-Type -AssemblyName 'System.Security'
4
$SignedCryptoMsgSyntax = New-Object -TypeName System.Security.Cryptography.Pkcs.SignedCms
5
$SignedCryptoMsgSyntax.Decode([System.IO.File]::ReadAllBytes($CIPolicyBin))
6
$SignedCryptoMsgSyntax.Certificates | Format-List -Property *

Deleting from the Windows File System#

Signed policy files reside in the following OS volume locations:

Result: If the file is deleted and the system is restarted — nothing happens. The policy remains active. Enforcement is still shown in msinfo32.exe. This behavior is by design — it protects against rogue administrators attempting to bypass security post-boot. The active policy in memory and on the EFI partition continues to govern execution.

Deleting from the EFI Partition#

The EFI partition stores policy files at:

Result: Deleting the policy from the EFI partition has no immediate effect. However, on the next reboot, the system will fail to boot. Secure Boot detects the missing or invalid signature and prevents the operating system from starting.

Recovery options:

1. Enter UEFI firmware settings and manually disable Secure Boot.

flowchart TD
    ATTACKER[Attacker / Rogue Admin] --> TRY1[Delete from\nCodeIntegrity folder\non C: drive]
    ATTACKER --> TRY2[Delete from\nEFI Partition\nCiPolicies folder]
    TRY1 --> RESULT1[System restarts\nPolicy STILL enforced\nLoaded from EFI copy]
    TRY2 --> RESULT2[System restarts\nSECURE BOOT BLOCKS\nOS will not load]
    RESULT2 --> RECOVER[Recovery options:]
    RECOVER --> R1{UEFI password\nprotected?}
    R1 -->|Yes| STUCK[Cannot access UEFI\nReplace signed policy via\nexternal media]
    R1 -->|No| R2[Disable Secure Boot\nin UEFI settings]
    R2 --> R3[BitLocker recovery key required\n48-digit key per encrypted drive]
    style RESULT1 fill:#1c1400,color:#fbbf24
    style RESULT2 fill:#7f1d1d,color:#fca5a5
    style STUCK fill:#14532d,color:#86efac

Why UEFI/BIOS Password Is Critical#

Always protect the UEFI/BIOS with a password. This is a key security recommendation for any environment deploying signed ACfB policies.

Step 1: Create a Replacement Policy#

Create a new replacement policy that satisfies all of the following conditions:

• Rule Option 6 enabled: Enabled:Unsigned System Integrity Policy
• Uses the same Policy ID (GUID) as the existing signed policy
• Has a higher or equal version number than the existing policy
• Contains an <UpdatePolicySigners> section referencing the same code signing certificate thumbprint
• Is signed with a certificate listed in the <UpdatePolicySigners> of the original policy

Step 2: Stop the Old Policy from Being Re-deployed#

If the original signed policy was deployed via Group Policy, Intune, or another management method, disable or unlink that deployment first. Failing to do so will cause the old signed policy to be re-applied after reboot, overwriting the replacement.

Step 3: Deploy the Replacement Policy#

Deploy the replacement policy using the same method as the original (GPO, Intune, or CiTool locally).

Restart the device.

Step 4: Remove the Replacement Policy#

Once the device has rebooted with the replacement policy active, remove it using CiTool:

1
CiTool.exe --remove-policy "{YourPolicyId-GUID}"

Restart the device.

Step 5: Delete Policy Files from Disk#

After the policy is inactive, delete the remaining policy files from both the OS volume and the EFI partition.

Multi-policy format:

1
<EFI Partition>\Microsoft\Boot\CiPolicies\Active\{PolicyId}.cip
2
C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{PolicyId}.cip

Single-policy format:

1
<EFI Partition>\Microsoft\Boot\SiPolicy.p7b
2
C:\Windows\System32\CodeIntegrity\SiPolicy.p7b

Restart the device.

flowchart TD
    START[Need to remove\nsigned policy] --> STOP[Step 1: Stop re-deployment\nDisable GPO / Intune assignment]
    STOP --> REPLACE[Step 2: Create Replacement Policy\n— Same PolicyID GUID\n— Higher or equal version\n— Option 6 re-enabled\n— UpdatePolicySigner included\n— Signed with SAME certificate]
    REPLACE --> SIGN[Step 3: Sign replacement\nwith original certificate]
    SIGN --> DEPLOY[Step 4: Deploy replacement\nvia same method]
    DEPLOY --> REBOOT1[Step 5: Reboot device]
    REBOOT1 --> REMOVE[Step 6: CiTool.exe\n--remove-policy PolicyGUID]
    REMOVE --> REBOOT2[Step 7: Reboot device]
    REBOOT2 --> DELETE[Step 8: Delete .cip files\nfrom disk + EFI partition]
    DELETE --> REBOOT3[Step 9: Final reboot]
    REBOOT3 --> DONE[Policy fully removed]
    style START fill:#3b1515,color:#fca5a5
    style DONE fill:#14532d,color:#86efac
    style SIGN fill:#162032,color:#58a6ff

flowchart TD
    UEFI[UEFI Firmware\nPassword Protected] --> SB[Secure Boot\nEnabled]
    SB --> EFI_LOAD[Load EFI Policy\nPolicyGUID.cip from EFI partition]
    EFI_LOAD --> CI[Code Integrity\nVerifies policy signature]
    CI --> CHAIN[Certificate chain\nvalidated against UEFI DB]
    CHAIN --> OS[Windows OS loads\nwith policy enforced]
    OS --> BL[BitLocker FDE\n48-digit recovery key]
    BL --> APPS[All applications\nvalidated before execution]
    style UEFI fill:#1a0a2e,color:#c4b5fd,stroke:#7c3aed
    style SB fill:#162032,color:#58a6ff
    style APPS fill:#14532d,color:#86efac