App Control for Business (WDAC \u2013 Windows Defender Application Control) is an extremely powerful function in Windows 10\/11. When set up correctly this pretty much rules out that malware is able to start (or can easily achieve persistence). It can be configured in a way that even a user with local admin privileges becomes unable to change, remove or disable strict rules.<\/p>\n\n\n\n
This powerful kernel-mode feature comes at a price. The price is complexity and a steep learning curve. A steep learning curve has never discouraged me despite my serious concentration issues. Once I got into using Qubes OS I never really looked back. My real problem with WDAC lies in it\u2019s complexity.<\/p>\n\n\n\n\n\n\n\n
Star Trek III wasn\u2019t one of the good movies, but there is an excellent quote by Scotty in there:<\/p>\n\n\n\n
\n\u201cThe more they overthink the plumbing, the easier it is to stop up the drain.\u201d<\/p>\n<\/blockquote>\n\n\n\n
This is an accurate description for overly complex software. There are many different locations where policies are stored includind the EFI partition. Installing multiple different Windows versions on the same PC might even automatically enforce policies from EFI partition on an OS where you never activated App Control.<\/p>\n\n\n\n
Erratic Smart App Control<\/h2>\n\n\n\n
What happened on my mum\u2019s PC was erratic behavior of the end user version, known under the term \u201cSmart App Control (SAC)\u201d right from the beginning (October 2025). My mistake was that I didn\u2019t draw the obvious conclusion: I should have reinstalled Windows within the first week!<\/strong> SAC disallowed well-known software like Mullvad VPN and blocked harmless casual games that worked on another Windows 11 PC.<\/p>\n\n\n\n
Instead of just reinstalling Windows, I went with the complex plumbing route. I created and maintained custom rules allowing apps and games manually. This worked for some months. At some point
citool.exe<\/code> refused to accept any commands. Updating policies, removing policies, adding policies \u2013 no matter what I tried\u2026 only got cryptic errors with no search results available and WDAC went full \u201cBlock Everything\u201d mode. Only system restore could make the PC usable again. Any time touchingcitool.exe<\/code> the result was the same. Error\u2192 Block All.<\/p>\n\n\n\nThere is no official way to factory reset a corrupted App Control rule set (at least I did not find any) other than the full nuclear option: Fresh Windows install.<\/p>\n\n\n\n
What might have happened?<\/h2>\n\n\n\n
I have no idea what was the problem. I can just speculate. I assume the shop owner has a sysprep-image of Windows that he flashes to all newly build PCs. Instead of starting over every time when a new Windows 11 version is released, he probably runs an upgrade keeping his changes, settings and software selection intact. Leftover policies (unused) from older versions might contain contradicting directions.<\/p>\n\n\n\n
Since his primary audience\/customers are gamers \u2013 and not security nerds \u2013 the first and only thing such customers will most likely do regarding App Control is deactivate SAC \u2013 like recommended in hundreds of clickbait YouTube videos with big red arrows in their thumbnail image.<\/p>\n\n\n\n
I Won\u2019t Give Up!<\/h2>\n\n\n\n
For my mum\u2019s PC Smart App Control is the right thing. If it continues working automatically this is a clear case of \u201cGood enough!\u201d<\/em>. For my hobby it is not enough. I will go all the way and deploy signed policies to unleash the full potential of App Control. Until I\u2019m confident that I actually understand what I\u2019m doing a Virtual Machine on my Dell laptop will be the guinea pig.<\/p>\n","protected":false},"excerpt":{"rendered":"
App Control for Business (WDAC \u2013 Windows Defender Application Control) is an extremely powerful function in Windows 10\/11. When set up correctly this pretty much rules out that malware is able to start (or can easily achieve persistence). It can be configured in a way that even a user with local admin privileges becomes unable […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,19],"tags":[37,14,10,38,23,24],"class_list":["post-264","post","type-post","status-publish","format-standard","hentry","category-security","category-software","tag-app-control","tag-security","tag-stupid-error","tag-wdac","tag-windows-10","tag-windows-11"],"_links":{"self":[{"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/posts\/264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=264"}],"version-history":[{"count":3,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/posts\/264\/revisions"}],"predecessor-version":[{"id":267,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=\/wp\/v2\/posts\/264\/revisions\/267"}],"wp:attachment":[{"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kleinessinchen.feralnetworks.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}