Control applications with AppLocker — reference notes
Review AppLocker's recorded purpose and the Group Policy editor location for creating exportable rules. The source also flags its maintenance status; this is not a current product-selection decision.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Control applications with AppLocker
Applocker can be used to lock down the applications that are allowed to run on a device. This allows us to prevent the installation and running of any application, installer, MS Store app or script, unless EXPLICITLY allowed.
While this is most relevant for student devices, to ensure only ALLOWED software runs, it can be extended to staff devices if required.
The source flags AppLocker maintenance status and mentions WDAC, App Control for Business and Attack Surface Reduction as alternatives. It does not clearly distinguish those terms or establish a reviewed migration choice.
Creating Rules
The easiest way to create rules is using the Group Policy editor on a windows 11 device and then exporting those rules for use in Intune.
Open gpedit.msc, Computer Configuration>Windows Settings>Security Settings>Application Control Policies>AppLocker to create the rules as follows.