Kim & Tom

In Part 1 , we explained how Managed Installers work: AppLocker policy defines trusted processes, those processes tag files with NTFS Extended Attributes, and WDAC Rule Option 13 tells your policy to trust those tagged files. In Part 2 , we covered the backlog problem and how security catalogs solve it. Now it's time to look at how managed installers are actually configured in ConfigMgr and Intune environments. Both platforms have built-in support for setting up managed installers for their...

AppControl.AI analyzed all Microsoft Defender for Endpoint threat intelligence reports published in 2025 to measure the real-world effectiveness of Windows application allowlisting. The results are now available in our yearly report.

Why existing applications create operational challenges and what to do about them In Part 1 , we covered how Managed Installers work and why they make AppControl for Business/WDAC deployment feasible. The core benefit is straightforward: instead of creating explicit allow rules for thousands of individual files, you trust your deployment process. Files written by managed installer processes receive NTFS Extended Attributes that WDAC recognizes as trusted. This works well for applications...