Mastering App Control for Business | Part 4: How to create a “starter base policy” for lightly managed devices

April 13, 2025

In the last three blog posts about App Control for Business, I talked a lot of theory and explained the key concepts behind the different policy types and options. Now, in this blog post, I will start to get more practical and show you how to create a starter policy for lightly managed devices using Smart App Control policy as a template.

As you might remember from my first blog posts in this series: Mastering App Control for Business | Part 1: Introduction & Key Concept, Smart App Control is an app control based security solution already built into Windows 11 and originally designed for consumer use. For enterprise managed devices Smart App Control is automatically disabled. However, it use the same technology so it is a useful starting point to get more familiar with App Control for Business as it includes the most of the Microsoft recommended block rules that are well-suited for lightly managed devices. by the end of this blog post, you will have a starting point and a policy running in audit mode.

Previous Blog Posts:

Story

Imagine my company is called “My Big Business Company”. They want to improve how they manage apps on their windows based company laptops and PCs. Right now, employees can install and run almost any app they want. That was okay in the past, but now “My Big Business Company” wants to make things safer by blocking apps that aren’t allowed or could be risky.

Patrick is a team member of the “My Big Business Company” IT department and want to rolling out App Control for Business.

Patrick knows that if they block too many apps at once, many employees might get frustrated. So, he wants to start slowly. His plan for short-term is to create one smart standalone policy that works well for most people in the company and expand the policy with more restrictive rules in the future.

To do this, he picks the “Signed & Reputable” policy template

%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml

for modification. This template allows only apps that are well-known and signed by publicly trusted companies or unsigned apps that have a good reputation are executable. It’s a good starting point and let the most business apps run smoothly, while keeping out unknown or unsafe software. To evaluate the reputation of an App, App Smart App Control uses the Intelligent Security Graph (ISG).

Patrick has identified the following requirements for a policy:

Windows components, Microsof Store Apps, Microsoft 365 Apps, Microsoft certified kernel drivers and all Microsoft signed applications must be allowed (already built in the Smart App Control policy template)
Publicly-trusted signed code must be allowed (already built in the Smart App Control policy template)
Apps with a good reputation must be allowed (Intelligent Security Graph (ISG)) (already built in the Smart App Control policy template)
Intune should be configured as a managed installer
Does not need a reboot after deployment

Create the policy from template

Manual processing

As I described above, Windows 11 22H2 and newer has a built in example App Control for Business template that is based on Smart App Control. The filename is named SmartAppControl.xml and is located in the folder: %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies

I copied the file to my working dir:

Remove Conditional Windows Lockdown Policy

The first steps are removing some code snippets that aren’t supported for the managed version of App Control for Business Policies:

    <Rule>
      <Option>Enabled:Conditional Windows Lockdown Policy</Option>
    </Rule>

and

<Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="ShellSmartscreenSuppressed"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
        <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="BrowserSmartscreenSuppressed"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="ISGSmartscreenTrustSuppressed"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableUI"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownOfficeExtensions"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputablePerfMode"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableTrustMode"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownDangerousExtensionValidation"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="WindowsLockdownDangerousExtensionEnforcement"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="DisableMshtmlUmci"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>
    <Setting Provider="Microsoft" Key="WindowsLockdownPolicySettings" ValueName="VerifiedAndReputableAllowAntiMalware"> 
      <Value> 
        <Boolean>true</Boolean> 
      </Value> 
    </Setting>

Set basic policy information

It is recommended to set some base information and generate a new policy id instead of using the original id from the template. You can do this using the PowerShell cmdlets: Set-CIPolicyVersion and Set-CIPolicyIdInfo.

Policy Version

Set-CIPolicyVersion -FilePath .\SmartAppControl.xml -Version "1.0.0.0"

Policy Name

Set-CIPolicyIdInfo -FilePath .\SmartAppControl.xml -PolicyName "MyBigBusinessBasePolicy"

Policy ID

$guid = New-Guid
Set-CIPolicyIdInfo  -FilePath .\SmartAppControl.xml -PolicyId $guid

Now, you can validate the changed information with the following commands:

The policy version can not be queried using a PowerShell command but it is included in the policy xml file.