Find out what App Control would block in your environment — then build a policy from what you find.
Requires Microsoft Defender for Endpoint with Advanced Hunting · Advanced Hunting retains 30 days of data
Application control is the single most effective thing you can do to stop untrusted code running — and the one most organisations never finish deploying. The reason is almost always the same: nobody can answer “what will break if I turn this on?”
This page of Highwind answers that question using data your tenant is already collecting. Deploy an audit-mode policy, let it run, and every Code Integrity event lands in Advanced Hunting. Highwind pulls those events, compares them against real policy files, and tells you exactly which applications are not yet covered.
Each step depends on the one before it. Do them in this order.
One row should equal one thing you would write a rule for. Match this setting to the rule type you plan to author.
Smallest result. One row per signer. Use when you intend to trust vendors wholesale with Publisher rules.
The usual starting point. One row per product per vendor — small enough to read end to end, specific enough to decide on.
One row per distinct file, ignoring version and location. Matches FilePublisher / FileName rules and collapses per-user install paths automatically.
One row per file per folder, with user-profile paths normalised to \Users\*\. Use when authoring FilePath rules.
Largest result. Every version of every binary. Only for Hash rule authoring — expect this to be very large.
C:\Users\<name>\AppData, so one application can produce one row per user — hundreds of thousands of rows describing a single app. Grouping at the level you will actually write rules at removes that at source, before any result-size limit is reached.
Group by decides how rows are grouped. Rule precedence, on the right of the same toolbar, decides which rule each row is recommended. They list similar-sounding names, so they are easy to confuse — but they are independent, and precedence is the one that shapes your finished policy.
It behaves exactly like PowerShell New-CIPolicy -Level <first> -Fallback <rest>: the first level an event actually satisfies wins. Drag to re-rank, or select and use the arrows. The order is saved between sessions, and a custom badge appears whenever it differs from the recommended default.
| Level | Matches on | Survives an update? |
|---|---|---|
| FilePublisher | Signer + original file name + minimum version | Yes — the usual right answer |
| Publisher | Signer + issuing CA | Yes — broadest; trusts a vendor's whole catalogue |
| SignedVersion | Signer + minimum version | Yes |
| FileAttribute | PE header fields (InternalName, ProductName) | Usually — good for signed files that get renamed |
| FileName | File name only | Yes, but defeated by renaming a file |
| Hash | Exact SHA256 | No — breaks on every patch |
| FilePath | Any file in a location | Yes, but only safe where standard users cannot write |
FilePath rule under C:\Users\ is user-writable — it effectively means "allow anything".
Recommended order, and what Reset to defaults restores: FilePublisher → Publisher → SignedVersion → FileAttribute → FileName → Hash → FilePath. After changing the order, existing results are stale until you re-evaluate — use Apply & re-compare in the same panel.
Disposition is the result of comparing each event against the policies you loaded.
The Recommend column suggests the rule type that would authorise the file, based on the metadata the event actually carries — a signer if one exists, otherwise file attributes, a path, or a hash as a last resort.
A rollout is not a single sitting. You pull a month of data, work through the top publishers, email four application owners, and come back on Thursday. The Decisions workbench is what lets that work accumulate instead of starting over each time.
Advanced Hunting has a 30-day retention, a per-query complexity limit, a response-size cap and a request rate limit. On an estate of a few hundred thousand devices, all four bite.
-context.txt records the query window, the filters applied and the policies compared against, so the file can be handed to someone else without explanation.ConvertFrom-CIPolicy and deploy.The same guidance is available inside the app: Knowledge Base → Application Control → Advanced Hunting.