App Control for Business (WDAC – Windows Defender Application Control) is an extremely powerful function in Windows 10/11. When set up correctly this pretty much rules out that malware is able to start (or can easily achieve persistence). It can be configured in a way that even a user with local admin privileges becomes unable to change, remove or disable strict rules.
This powerful kernel-mode feature comes at a price. The price is complexity and a steep learning curve. A steep learning curve has never discouraged me despite my serious concentration issues. Once I got into using Qubes OS I never really looked back. My real problem with WDAC lies in it’s complexity.
Star Trek III wasn’t one of the good movies, but there is an excellent quote by Scotty in there:
“The more they overthink the plumbing, the easier it is to stop up the drain.”
This is an accurate description for overly complex software. There are many different locations where policies are stored includind the EFI partition. Installing multiple different Windows versions on the same PC might even automatically enforce policies from EFI partition on an OS where you never activated App Control.
Erratic Smart App Control
What happened on my mum’s PC was erratic behavior of the end user version, known under the term “Smart App Control (SAC)” right from the beginning (October 2025). My mistake was that I didn’t draw the obvious conclusion: I should have reinstalled Windows within the first week! SAC disallowed well-known software like Mullvad VPN and blocked harmless casual games that worked on another Windows 11 PC.
Instead of just reinstalling Windows, I went with the complex plumbing route. I created and maintained custom rules allowing apps and games manually. This worked for some months. At some point citool.exe refused to accept any commands. Updating policies, removing policies, adding policies – no matter what I tried… only got cryptic errors with no search results available and WDAC went full “Block Everything” mode. Only system restore could make the PC usable again. Any time touching citool.exe the result was the same. Error→ Block All.
There is no official way to factory reset a corrupted App Control rule set (at least I did not find any) other than the full nuclear option: Fresh Windows install.
What might have happened?
I have no idea what was the problem. I can just speculate. I assume the shop owner has a sysprep-image of Windows that he flashes to all newly build PCs. Instead of starting over every time when a new Windows 11 version is released, he probably runs an upgrade keeping his changes, settings and software selection intact. Leftover policies (unused) from older versions might contain contradicting directions.
Since his primary audience/customers are gamers – and not security nerds – the first and only thing such customers will most likely do regarding App Control is deactivate SAC – like recommended in hundreds of clickbait YouTube videos with big red arrows in their thumbnail image.
I Won’t Give Up!
For my mum’s PC Smart App Control is the right thing. If it continues working automatically this is a clear case of “Good enough!”. For my hobby it is not enough. I will go all the way and deploy signed policies to unleash the full potential of App Control. Until I’m confident that I actually understand what I’m doing a Virtual Machine on my Dell laptop will be the guinea pig.