Windows Defender Application Control (WDAC) goes beyond antivirus scanning entirely — it’s an allowlisting system that blocks any application not explicitly trusted from running at all, a fundamentally different security model.
Allowlisting vs Blocklisting
Traditional antivirus is a blocklist — it tries to recognize and block known-bad software, and inevitably misses genuinely new threats. WDAC flips this entirely: only explicitly trusted applications (by publisher certificate, file hash, or path) are permitted to run — everything else, known or unknown, malicious or not, is blocked by default.
# Create a base policy from a "golden" reference machine's currently installed software New-CIPolicy -Level Publisher -FilePath "InitialPolicy.xml" -UserPEs -ScanPath "C:\" # Convert to a deployable binary format ConvertFrom-CIPolicy -XmlFilePath "InitialPolicy.xml" -BinaryFilePath "SIPolicy.p7b" # Check current WDAC status on a machine Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard
Where It Makes Sense
WDAC is genuinely powerful for kiosks, point-of-sale systems, and tightly locked-down corporate machines where the exact set of needed software is well-defined and rarely changes — the operational overhead of maintaining allowlist policies makes it impractical for general-purpose developer workstations where software needs change constantly.