FIELD NOTES

Configure and manage AppLocker policy with Intune

intuneapplockerwindows

AppLocker policies let you control which apps can run on Windows devices. I use Intune to enforce them so endpoints stay clean and consistent.

The pattern that works best for me:

  • Build rules on a test device; use publisher rules for Microsoft + your OEM, and keep path rules minimal.
  • Export to AppLocker.xml and validate with Test-AppLockerPolicy against a few real executables (allowed and blocked).
  • Split the XML by RuleCollection (Exe/Msi/Script/Appx) before pushing via Intune custom OMA-URI.

Roll out in waves (DEV → pilot → prod), monitor Event Viewer for noisy blocks, and keep a rollback ready by versioning the XML you publish.

Build the rule set locally

  1. On a test machine open Computer Configuration > Windows Settings > Security Settings > Application Control Policies > Applocker.
  2. Under Executable Rules start creating publisher/path rules. Keep at least defaults plus broad publisher rules (Microsoft and your hardware vendor).
  3. When done, right-click AppLocker and Export Policy to AppLocker.xml. If you already have on-prem GPOs you can export those too.

Test your XML

Use Test-AppLockerPolicy before deploying:

Test-AppLockerPolicy -XmlPolicy "D:\AppLocker.xml" -Path "C:\Path\To\App.exe"

You should see Allowed/Blocked results. If there are syntax issues or duplicate nodes you'll get errors—fix them before rollout.

Prep XML for Intune OMA-URI

For each RuleCollection type (EXE, MSI, Script, APPX), copy only that section into its own XML snippet:

<RuleCollection Type="Exe" EnforcementMode="Enabled">
  ...
</RuleCollection>

Keep one file per type; it makes targeting and troubleshooting easier.

Create the Intune policy

  1. Intune portal → Devices → Configuration profiles → Create profile.
  2. Platform: Windows 10 or later. Profile type: Templates → Custom (OMA-URI).
  3. Add an OMA-URI per RuleCollection, paste the XML content, and assign to your test group.
  4. Roll out in waves (DEV → Pilot → Prod).

Troubleshoot duplicate nodes

Large XML exports can contain duplicates. This PowerShell snippet groups identical rules and keeps the first one:

[xml]$xml = Get-Content "F:\AppLocker\Win10_AppLocker.xml" -Raw
$xml.AppLockerPolicy.RuleCollection[0].FilePublisherRule |
  ForEach-Object { $_.OuterXml } |
  Group-Object |
  ForEach-Object { $_.Group[0] } |
  Set-Clipboard

Paste the deduped rules back inside the proper RuleCollection wrapper, save, and retest.

Good luck!

← All articles