Restrict unauthorized code execution with Code Integrity policies on Windows Server
Advanced
Administrator
Security Engineer
Windows Server
App Control for Business is a Code Integrity (CI) technology that restricts which executable code can run on a system. This module explains how to design, deploy, operate, and recover Code Integrity policies without losing critical server functions.
Learning objectives
By the end of this module, you'll be able to:
- Select a Windows Server 2025 policy architecture and management model.
- Predict authorization across enforced base policies, supplemental policies, and deny rules.
- Build, inspect, version, link, and compile appropriately scoped policies.
- Approve enforcement from audit evidence and workload tests.
- Diagnose binary, driver, PowerShell, and dynamic-code failures.
- Sign, update, retire, and recover policies while preserving workload availability.
Prerequisites
- Experience administering Windows Server, Hyper-V, and Active Directory Domain Services.
- Familiarity with PowerShell administration, Windows event logs, and application deployment.
- Understanding of code signing, Secure Boot, backups, and recovery procedures.
- To follow the examples, access to a representative Windows Server 2025 test environment with PowerShell 7.4 or later, Windows PowerShell 5.1, and independent recovery access.