The AppLocker Policy Converter is a Microsoft command-line utility that translates existing AppLocker policy files into App Control for Business policies, giving administrators a practical starting point for migrating away from the older application control feature.
The AppLocker Policy Converter is a command-line tool for organisations that already run AppLocker and want to move to App Control for Business. You point it at one or more exported AppLocker policy files and give it an output location, and it writes a converted policy that expresses those rules in the App Control format. Publisher rules are ported by carrying over the common name entries and chaining them to trusted roots, and path rules and file hash rules come across as well. The result is an editable policy file that describes what the organisation already trusts, which is far quicker than rebuilding years of accumulated exceptions from nothing.
The appeal of converting rather than rebuilding comes down to institutional memory. AppLocker policies usually grow over years, accumulating exceptions for line-of-business tools, drivers and third-party utilities, and that history is rarely documented anywhere except the policy itself. A conversion preserves those decisions as a reviewable artefact that a security team can inspect, tighten or discard rule by rule. It is a narrow tool compared with the wider assessment ecosystem: Microsoft Application Inspector examines what code inside a component actually does, while this converter only moves existing trust decisions between two policy formats. That focus is deliberate, because the conversion step itself should be repeatable and boring.
The main benefit of the AppLocker Policy Converter is that it turns an intimidating migration into a single command with a reviewable output. Instead of asking administrators to reconstruct every allow rule from memory, it produces a policy that reflects what the organisation already permits, so the conversation shifts from building a list to auditing one. The AppLocker Policy Converter also removes the temptation to leave the old system in place simply because rewriting policies is tedious, which matters when the older feature no longer matches the protections available on modern devices. Publisher rules that trusted a vendor's certificate generally keep working because the certificate chain is preserved, and path and hash exceptions survive as well, so the software people depend on does not disappear from the allowlist overnight. The converted file slots straight into existing policy review and deployment workflows.
Key capabilities and highlights.
AppLocker publisher rules survive conversion because the tool ports the common name entries and chains them to trusted roots, preserving the intent of rules that trusted a vendor's signature rather than a specific file. That keeps software updates from the same vendor working without an administrator rebuilding every rule by hand.
Rules that identify software by file path and by file hash are converted alongside publisher rules, so exceptions built around a particular folder or a fixed binary are not lost along the way. These are the rule types administrators lean on most when a publisher's signing habits are inconsistent.
More than one AppLocker policy path can be supplied in a single run, and the tool produces one converted policy from them. Organisations that kept policies separated by department or by rule collection end up with a single artefact to review, version and deploy rather than a folder of fragments.
The whole job is described by where the AppLocker policies live and where the converted policy should be written, plus a help switch for reference. That minimal surface makes the AppLocker Policy Converter easy to script, easy to repeat and easy to record in change documentation.
Because ported publisher rules are chained to trusted roots, the converted policy trusts certificates through the same chain the platform validates when it evaluates signing information. Anchoring rules that way keeps the output aligned with how App Control reasons about publisher trust at run time.
The converted output contains a signer rule reference, a structural detail that matters because policies frequently need to state which certificates may sign future updates. Having that element written from the start saves a separate authoring step when the policy is prepared for signing and deployment.
The tool works from exported policy files rather than a live Group Policy or local security policy store, so it can run on a workstation that never hosted AppLocker. Conversion can happen in a staging or build environment, and the finished file handed to whoever handles deployment.
The output is a starting point rather than a finished control. The documented path is to review the converted rules against current software, test them in audit mode so nothing is blocked unexpectedly, then publish through existing management tooling to the devices that need the policy.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about AppLocker Policy Converter.
It is a Microsoft command-line tool in the Application Control toolkit that converts AppLocker policy files into App Control for Business policies. You supply the exported policies and an output path, and it writes the converted policy for review.
Existing AppLocker policies hold years of accumulated exceptions that are rarely documented elsewhere. Converting preserves those decisions as a reviewable file, which is why Microsoft recommends conversion as the starting point of an AppLocker to App Control migration.
The tool is documented to handle publisher rules, path rules and file hash rules. Publisher rules are ported by carrying over the common name entries and chaining them to trusted roots so certificate-based trust continues to work.
Two required parameters: the paths to the AppLocker policies being converted, and the path where the converted policy should be written. A help switch lists the options, so no graphical console or interactive session is involved.
Yes. Multiple policy paths can be provided in the same invocation, and the AppLocker Policy Converter produces a single consolidated policy rather than one output file per input.
No. The tool only produces the policy file. It still has to be reviewed, tested, signed where your deployment model requires it, and deployed through your management tooling before it affects any device.
That is generally discouraged. Running the converted policy in audit mode first shows which applications would have been blocked, so unexpected gaps can be fixed before enforcement reaches production devices and disrupts users.
It is free. It is published as part of Microsoft's open-source Application Control toolkit alongside policy authoring tools and documentation, so administrators can use it and review its behaviour without licensing considerations.
The AppLocker Policy Converter is a Microsoft command-line utility that translates existing AppLocker policy files into App Control for Business policies, giving administrators a practical starting point for migrating away from the older application control feature.
Microsoft Safety Scanner is a free, portable on-demand scanning tool from Microsoft that finds and removes malware, spyware, and unwanted software from Windows PCs without installing anything.
The AppInstaller File Builder is a Microsoft tool from the MSIX Toolkit that generates .appinstaller files through a guided wizard, so packaged Windows apps can check a central location for updates and repair themselves without hand-written XML.
The Microsoft App Control Wizard is Microsoft's open-source desktop tool for building, editing and merging Application Control for Business policies, giving administrators a guided way to define exactly which applications and drivers may run on managed Windows devices.
TeamViewer Host is the module installed on a computer to make it permanently reachable for unattended remote access. It runs as a service, so administrators and colleagues can connect without anyone being present to approve the session.
Comments