The Microsoft App Control Wizard is Microsoft's open-source desktop tool for building, editing and merging Application Control for Business policies, giving administrators a guided way to define exactly which applications and drivers may run on managed Windows devices.
The Microsoft App Control Wizard is a Windows desktop application for creating, editing and merging Application Control for Business policies, the rules that decide which code is allowed to execute on a device. Its workflow is deliberately linear: choose a template that matches your trust model, name the policy, then step through policy options and signer or file rules, adding custom rules as needed before generating the finished policy. Because it drives the App Control PowerShell cmdlets and management API underneath, the policy it produces matches what those cmdlets would emit. The purpose is straightforward: make an otherwise unforgiving allowlisting technology approachable for administrators who are not comfortable hand-authoring policy XML.
The Microsoft App Control Wizard sits in the security toolkit rather than the app development toolbox. Where a helper such as winui-search exists to help developers find WinUI control samples, this tool exists to help administrators decide which software is trusted enough to run, and it keeps that decision visible at every step instead of hiding it in XML. It is maintained by the App Control product team and published as open source, so security architects can review how rules are generated, read the documentation, and feed problems back to the team. Audit mode is enabled by default in every template, which nudges first-time users toward testing a policy and reading its events before enforcement begins.
The most immediate benefit of the Microsoft App Control Wizard is that it removes the fear factor from policy authoring. Instead of writing and validating XML by hand, you pick a template, toggle rule options with plain-language descriptions, and build signer or file rules from a reference binary with a slider that sets how broad the rule should be. Because those rules map onto the same levels the platform understands, a publisher rule, a file version rule, a file name rule or a plain file path, the result is predictable rather than experimental. The Microsoft App Control Wizard also closes the loop between what a policy blocks and what it should allow, since audit events can be turned directly into new rules from local logs, remote logs or exported files, which shortens the gap between pilot and enforcement. Merging keeps scattered work consolidated, and the identical output to the underlying cmdlets means nothing is lost when the policy moves into deployment tooling.
Key capabilities and highlights.
Start a base policy from one of three supplied templates that define progressively wider trust, from a Windows-only allowlist through to Microsoft-signed software and reputation-based authorization. Each template arrives with sensible rule options already selected, so a first draft of a policy exists within minutes rather than after hours of schema reading.
Toggle the settings that shape enforcement, including script enforcement, hypervisor-protected code integrity, managed installer support and Intelligent Security Graph authorization, with hover descriptions explaining what each one does. Advanced options such as boot audit on failure, dynamic code security and runtime file path protection sit behind a second panel rather than buried in documentation.
Build rules from a reference binary and slide between issuing certificate authority, publisher, file version and file name, trading breadth for precision in a way that stays visible while you work. File path rules and file name rules based on original filename, product name or internal name cover the cases that signing attributes alone cannot.
When a binary's attributes are unavailable or too loose to trust, the tool can identify it by hash, and it falls back to a hash rule automatically if the requested rule level cannot be produced from the file you selected. That fallback keeps an essential application usable without pushing you into hand-edited policy XML.
Read application control events from local event logs, remote logs or comma-separated exports and turn the entries you trust into proper allow rules. This is the practical bridge between audit mode and enforcement, because the software users actually depend on shows up in the logs long before it shows up in a policy.
Create a supplemental policy that extends an existing base policy, letting you approve additional software without loosening the trust model of the base itself. The tool verifies that the base was configured to allow supplemental policies and confirms the relationship before anything reaches a device.
Combine two or more policies into a single policy when separate teams have each authored their own rules. The merge takes the union of the parts, and the tool documents a limit on how many policies one merge can include, which keeps consolidation predictable rather than a guessing game about what survived.
Reopen a base or supplemental policy to adjust rule options or delete individual file rules without starting from scratch. The Microsoft App Control Wizard then writes the result as readable XML and as the binary policy form deployment tools expect, and because the underlying cmdlets do the work, the output matches what scripting would have produced.
Browse historical releases and previous builds.
Common questions about Microsoft App Control Wizard.
It is Microsoft's official open-source Windows desktop application for authoring Application Control for Business policies. It creates base and supplemental policies from templates, edits existing ones, merges multiple policies, and generates both XML and binary policy files for use elsewhere.
No. The Microsoft App Control Wizard is a graphical front end that runs the App Control PowerShell cmdlets in the background, so administrators who prefer clicking through options reach the same result as someone writing commands by hand. Scripting remains useful for automating policy updates and deployment.
A base policy defines the core trust for a device, including which signers and rule options apply. A supplemental policy extends an existing base to approve additional software, and it only takes effect if the base policy was created with the option that allows supplemental policies.
Yes. The tool can read application control events from local event logs, remote logs or exported comma-separated files and convert trusted entries into allow rules, which is the normal way to grow a policy after running it in audit mode and reviewing what users needed.
It can. Merging combines two or more policies into one policy representing their union, and the documentation notes a ceiling on how many policies a single merge can include, which matters when several teams have each maintained their own rule sets.
No, it authors them. Deployment happens through management tooling such as Intune, Configuration Manager, group policy or scripts, and the policy files the tool produces are designed to slot into those existing management channels rather than replacing them.
Audit mode logs an event when an application outside the policy starts instead of blocking it, so every supplied template ships with it enabled. That lets you see what a policy would have stopped, close the gaps, and only then move the policy into enforcement.
It is free and open source, maintained by the App Control product team at Microsoft with source code and documentation published publicly. Administrators can therefore inspect how rules are generated and raise issues, rather than treating the tool as a closed black box.
The Microsoft App Control Wizard is Microsoft's open-source desktop tool for building, editing and merging Application Control for Business policies, giving administrators a guided way to define exactly which applications and drivers may run on managed Windows devices.
Microsoft Safety Scanner is a free, portable on-demand scanning tool from Microsoft that finds and removes malware, spyware, and unwanted software from Windows PCs without installing anything.
The AppLocker Policy Converter is a Microsoft command-line utility that translates existing AppLocker policy files into App Control for Business policies, giving administrators a practical starting point for migrating away from the older application control feature.
The AppInstaller File Builder is a Microsoft tool from the MSIX Toolkit that generates .appinstaller files through a guided wizard, so packaged Windows apps can check a central location for updates and repair themselves without hand-written XML.
TeamViewer Host is the module installed on a computer to make it permanently reachable for unattended remote access. It runs as a service, so administrators and colleagues can connect without anyone being present to approve the session.
Comments