windows-itpro-docs/windows/security/application-security/application-control/windows-defender-application-control/design/example-wdac-base-policies.md

title, description, ms.topic, ms.prod, ms.localizationpriority, author, ms.reviewer, ms.author, manager, ms.date, ms.technology

title	description	ms.topic	ms.prod	ms.localizationpriority	author	ms.reviewer	ms.author	manager	ms.date	ms.technology
Example Windows Defender Application Control base policies	When creating a Windows Defender Application Control (WDAC) policy for an organization, start from one of the many available example base policies.	reference	windows-client	medium	jsuther1974	jogeurte	vinpa	aaroncz	03/31/2023	itpro-security

Windows Defender Application Control example base policies

Applies to:

• Windows 10
• Windows 11
• Windows Server 2016 and above

Note

Some capabilities of Windows Defender Application Control are only available on specific Windows versions. For more information, see Windows Defender Application Control feature availability.

When you create policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that you can use. These example policies are provided "as-is". You should thoroughly test the policies you deploy using safe deployment methods.

Example Base Policy	Description	Where it can be found
DefaultWindows_*.xml	This example policy is available in both audit and enforced mode. It includes rules to allow Windows, third-party hardware and software kernel drivers, and Windows Store apps. Used as the basis for the Microsoft Intune product family policies.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_*.xml %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\DefaultWindows_Audit.xml
AllowMicrosoft.xml	This example policy includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\AllowMicrosoft.xml
AllowAll.xml	This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml
AllowAll_EnableHVCI.xml	This example policy can be used to enable memory integrity (also known as hypervisor-protected code integrity) using WDAC.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll_EnableHVCI.xml
DenyAllAudit.xml	Warning: Will cause boot issues on Windows Server 2019 and earlier. Do not use on those operating systems. Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml
Microsoft Configuration Manager	Customers who use Configuration Manager can deploy a policy with Configuration Manager's built-in WDAC integration, and then use the generated policy XML as an example base policy.	%OSDrive%\Windows\CCM\DeviceGuard on a managed endpoint
SmartAppControl.xml	This example policy includes rules based on Smart App Control that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see Create a custom base policy using an example base policy.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\SignedReputable.xml
Example supplemental policy	This example policy shows how to use supplemental policy to expand the DefaultWindows_Audit.xml allow a single Microsoft-signed file.	%OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Supplemental.xml
Microsoft Recommended Block List	This policy includes a list of Windows and Microsoft-signed code that Microsoft recommends blocking when using WDAC, if possible.	Microsoft recommended block rules %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\Recommended_UserMode_Blocklist.xml
Microsoft recommended driver blocklist	This policy includes rules to block known vulnerable or malicious kernel drivers.	Microsoft recommended driver block rules %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\RecommendedDriverBlock_Enforced.xml %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\Recommended_Driver_Blocklist.xml
Windows S mode	This policy includes the rules used to enforce Windows S mode.	%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\WinSiPolicy.xml.xml
Windows 11 SE	This policy includes the rules used to enforce Windows 11 SE, a version of Windows built for use in schools.	%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\WinSEPolicy.xml.xml

Note

Not all policies shown available at %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies can be found on all versions of Windows.