Step 1: Create WDAC Policy
You can create WDAC policies using:
- PowerShell: Use
New-CIPolicy cmdlets to create policies
- WDAC Wizard: Use the Windows Defender Application Control Wizard (available as a download)
- ConfigCI: Use the ConfigCI PowerShell module
Step 2: Export the Policy
Export your WDAC policy to XML format:
- PowerShell: Use
Export-CIPolicy -FilePath policy.xml to export an existing policy
- Or: If you created a policy using the wizard, it should already be in XML format
Step 3: Convert Using This Tool
Upload or paste your WDAC policy XML file below. The tool will convert it to Fleet-compatible SyncML format for MDM deployment.
Step 4: Verify Policy Deployment
After deploying via Fleet, verify the policy is applied:
- In Fleet: Check policy status and device compliance in the Fleet console
- Test (Most Reliable): Try running a blocked application - if you see a block message, the policy is working correctly
- PowerShell: Run
Get-CIPolicy to view applied WDAC policies
- Event Viewer: Check Applications and Services Logs → Microsoft → Windows → Code Integrity → Operational for policy events
⚠️ Important: WDAC policies are system-wide and more restrictive than AppLocker. Always test on a small group before deploying organization-wide. Some policy changes may require a device reboot.