AppLockerWDAC

AppLockerWDAC refers to the integration and combined functionality of two Windows security features: AppLocker and Windows Defender Application Control (WDAC). AppLocker is a feature that allows IT administrators to control which applications users can run on their Windows devices. It achieves this by creating rules based on criteria such as publisher, path, or file hash. WDAC, also known as Application Control, is a more robust and foundational security technology that enforces a policy to only allow trusted applications and drivers to run. It operates at a lower level in the operating system, making it more difficult to bypass than AppLocker.

When AppLocker and WDAC are discussed together, it often implies a comprehensive strategy for application whitelisting or control. Administrators may use AppLocker for broader, policy-based application control, while leveraging WDAC for more stringent, kernel-level enforcement, particularly in high-security environments. The goal of using these technologies in tandem is to significantly reduce the attack surface by preventing the execution of unauthorized or potentially malicious software, including malware, ransomware, and unwanted applications. This layered approach enhances overall endpoint security by ensuring that only approved code can run on a system.