Summary
App Control for Business is both a trust boundary and a maintained operational control. A successful deployment restricts unnecessary code while preserving the complete workload and a viable recovery path.
Base policies intersect. Authorized supplements expand only their linked base. Explicit enforced denies take precedence. File identities, policy identities, signing permissions, and runtime behavior must all agree with the intended design.
Windows Server 2025 provides inbox CiTool and an opt-in OSConfig management path. Use the owner of each policy to change its state. Don't let drift correction and direct file manipulation compete.
PowerShell 7 is the orchestration host for these examples. Explicit 5.1 workers preserve the required Windows module dependencies; they don't remove policy restrictions. Verify local, worker, and remote execution contexts separately, including script block/sandbox decisions and PowerShell audit evidence.
Hyper-V validation must include mobility, drivers, agents, backup, and recovery. Domain controller validation must include authentication, DNS, replication, SYSVOL, and independent administrative access. Host and guest policies protect separate operating systems.
Before approving any release, confirm the following operational conditions:
- The trust model and every effective policy family are understood.
- Rule scope, identities, versions, and signer permissions have been reviewed.
- The approved PowerShell version, required worker modules, and remote endpoint are available and authorized.
- Audit evidence covers complete workload cycles and known negative tests.
- Canary enforcement has passed functional and restart checks.
- Signed-policy updates, signer rollover, and retirement are supported.
- Recovery access and artifacts remain available during an identity or host outage.
- Deployment ownership, monitoring, exceptions, and future servicing are assigned.
More info
Use these authoritative references for detailed syntax, current platform caveats, and recovery procedures. The Windows Server 2025-specific guidance takes precedence over older-version assumptions in broader articles.
| Reference | Use it for |
|---|---|
| Install PowerShell on Windows | Separate PowerShell 7 installation and supported installation methods. |
| PowerShell 7 module compatibility | Native and compatibility-layer status for Windows Server modules. |
| Windows PowerShell compatibility | The 5.1 dependency, serialized objects, and compatibility limitations. |
| New-PSSession | Explicit local Windows PowerShell workers with -UseWindowsPowerShell. |
| Enable-PSRemoting | Endpoint registration, runtime selection, and configuration side effects. |
| PowerShell App Control behavior | Version-dependent file authorization, blocking, sandboxing, and lockdown restrictions. |
| PowerShell App Control audit diagnostics | PowerShell 7.4+ audit behavior and event 16387. |
| Event channel configuration | Analytic-log enablement clears existing events. |
| Analytic-log query restrictions | Circular analytic logs must be disabled before querying. |
| App Control and AppLocker feature availability | Supported capabilities and policy boundaries. |
| App Control and memory integrity | Hardware requirements and the distinction between App Control and memory integrity. |
| Configure App Control with OSConfig | Server 2025 scenarios, supplements, effective state, and drift correction. |
| Install the OSConfig module | Online and offline preparation. |
| Microsoft.OSConfig 1.4.10 package | Version-specific implementation, including ConfigCI conversion and the Windows PowerShell scheduled task. |
| Policy options and file rules | Rule levels, options, version bounds, paths, and hashes. |
| Use multiple App Control policies | Base/supplemental composition and policy identity. |
| Example base policies | Template trust scope and starting points. |
| ConfigCI cmdlets | Windows Server 2025 authoring and conversion syntax. |
| New-CIPolicyRule | Targeted rules, fallback levels, and supported parameters. |
| CiTool reference | Policy inventory, activation, refresh, and removal. |
| Deploy policies using scripts | Server-specific deployment and signed-policy placement. |
| Group Policy deployment | The legacy single-policy setting and its limits. |
| Generate rules from audit events | Candidate generation and missing-file limitations. |
| Understanding App Control events | Event IDs, signatures, correlation, and Server Core limitations. |
| Script enforcement | PowerShell, other script hosts, and COM behavior. |
| App Control and .NET | Dynamic Code Security and native-image behavior. |
| Obtain an internal code-signing certificate | AD CS code-signing templates, enrollment, and the signing user's certificate store. |
| Certification authority hierarchies | Trusted roots, issuing CAs, and end-entity certificate chains. |
| Signed policy protection | Signing requirements, authorized signers, and restart testing. |
| Remove policies and recover from boot failures | Signed-base retirement and emergency recovery. |
| Known issues and administrative guidance | Performance, compatibility, signatures, and troubleshooting. |
| Recommended application block rules | Risk from otherwise trusted applications. |
| Recommended driver block rules | Vulnerable drivers and safe blocklist deployment. |
| Managed installer | Origin claims, prerequisites, and limitations. |
| Signed catalogs | Legacy application capture, signing, and distribution. |
| Policy lifecycle management | Staged releases, stable identities, and support ownership. |
| Hyper-V security | Host/guest boundaries and virtualization administration. |
| Domain-controller security | Identity-critical administration and virtual domain controller considerations. |