Whenever enabling a technology that will effectively block stuff, it is highly recommended to first assess the situation obtaining intel about what would happen if we set a feature like this in On or Block mode. Goal is to set On (Block) mode, but first Evaluation (Audit) mode Only for fresh deployment/installations, or resets of Windows 11 22H2.Īny given time – whenever you choose to deploy it. You can create exceptions however, it involves a certain amount of administration and manual work. No exceptions possible – you are 100% in hands of Microsoft control and deciding what is trusted and reputable. See a number of examples on AppLocker bypasses here. AppLocker is too easy to circumvent, for instance by using a trusted process by AppLocker to load a malicious DLL file.

At the same time, it must be hard to circumvent which is true for both Smart App Control and Application Control. We need something more secure that also includes anything running on the machine, regardless of user space vs kernel space and also applies to local administrators. One thing to start with – forget AppLocker as it is too weak and has too many flaws. This blog post covers Smart App Control versus Defender Application Control in a cloud-native world, where Windows devices are connected only to Azure AD and Intune. Microsoft says this feature is intended for consumers and small businesses – and recommends larger organizations and enterprises to use Defender Application Control, which uses the same technology in the background, and has been available since the launch of Windows 10. This leaves us with a very high security posture. Anything not trusted will be blocked from running. Smart App Control is a new feature in Windows 11 22H2 that allows only certain trusted, verified and reputable executables, DLL files and MSI installers to run.

Windows defender application control