windows-itpro-docs/windows/security/application-security/application-control/windows-defender-application-control/applocker/create-your-applocker-rules.md

title, description, ms.localizationpriority, ms.topic, ms.date

title	description	ms.localizationpriority	ms.topic	ms.date
Create Your AppLocker rules	This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules.	medium	conceptual	09/21/2017

Create Your AppLocker rules

Note

Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the Windows Defender Application Control feature availability.

This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules.

Creating AppLocker rules

AppLocker rules apply to the targeted app, and they're the components that make up the AppLocker policy. Depending on your IT environment and the business group that requires application control policies, setting these access rules for each application can be time-consuming and prone to error. With AppLocker, you can generate rules automatically or create rules individually. Creating rules that are derived from your planning document can help you avoid unintended results. For info about this planning document and other planning activities, see AppLocker Design Guide.

Automatically generate your rules

You can use a reference device to automatically create a set of default rules for each of the installed apps, test and modify each rule as necessary, and deploy the policies. Creating most of the rules for all the installed apps gives you a starting point to build and test your policies. For info about performing this task, see the following topics:

• Configure the AppLocker reference device
• Run the Automatically Generate Rules wizard
• Create AppLocker default rules
• Edit AppLocker rules
• Add exceptions for an AppLocker rule

Create your rules individually

You can create rules and set the mode to Audit only for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you're targeting a few applications within a business group.

Note: AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see Create AppLocker default rules.

For information about performing this task, see:

1. Create a rule that uses a publisher condition
2. Create a rule that uses a path condition
3. Create a rule that uses a file hash condition
4. Edit AppLocker rules
5. Enforce AppLocker rules
6. Configure an AppLocker policy for audit only

About selecting rules

AppLocker policies are composed of distinct rules for specific apps. These rules are grouped by collection, and they're implemented through an AppLocker policy definition. AppLocker policies are managed by using Group Policy or by using the Local Security Policy snap-in for a single computer.

When you determine what types of rules to create for each of your business groups or organizational units (OUs), you should also determine what enforcement setting to use for each group. Certain rule types are more applicable for some apps, depending on how the apps are deployed in a specific business group.

For info about how to determine and document your AppLocker rules, see AppLocker Design Guide.

For info about AppLocker rules and AppLocker policies, see the following topics:

• Understanding AppLocker rule behavior
• Understanding AppLocker rule exceptions
• Understanding AppLocker rule collections
• Understanding AppLocker allow and deny actions on rules
• Understanding AppLocker rule condition types
• Understanding AppLocker default rules

Next steps

1. Import an AppLocker policy into a GPO
2. Import an AppLocker policy from another computer
3. Test and update an AppLocker policy
4. Deploy the AppLocker policy into production

Related topics

• Create Your AppLocker policies