WDAC Signed Policy Boot Failure Scenarios

Question

WDAC Signed Policy Boot Failure Scenarios

Shubham 0

Hi Everyone,
We are working on WDAC signed policy boot failure scenarios.

We created an XML policy with the following options enabled:

Option 9: Advanced Boot Options Menu

Option 10: Boot Audit on Failure
Using this XML, we created and signed a WDAC policy. After that, we deleted the .cip file from the EFIMount folder using the command below:
Remove-Item "C:\EFIMount\EFI\Microsoft\Boot\CiPolicies\Active*.cip" -Force

After rebooting the system, a boot failure occurred.

We would like clarification on the following points:

What is the intended use of Option 9 and Option 10 if a boot failure still occurs after enabling them?

If a boot failure occurs, is there any supported option or recovery mechanism to restore or recover the machine?

Any guidance or clarification would be greatly appreciated.

Thank you.

Catherine Kyalo 3,180 Reputation points Microsoft Employee

2026-04-16T16:43:13.4233333+00:00

Signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. Tampering with or removing a signed App Control policy will cause a BSOD to occur."*

Deleting the .cip file is exactly the tampering scenario that signed policies are designed to prevent. Option 10 cannot override this — it only covers driver-blocking failures, not policy integrity violations.

Reference: https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies#remove-app-control-policies-causing-boot-stop-failures

1 answer

Your answer

Catherine Kyalo 3,180 Reputation points Microsoft Employee

2026-04-16T16:43:13.4233333+00:00

Signed App Control policies protect the policy from administrative manipulation and malware that has gained administrative-level access to the system. Tampering with or removing a signed App Control policy will cause a BSOD to occur."*

Deleting the .cip file is exactly the tampering scenario that signed policies are designed to prevent. Option 10 cannot override this — it only covers driver-blocking failures, not policy integrity violations.

Reference: https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies#remove-app-control-policies-causing-boot-stop-failures

Answer 1

Option 9 (Advanced Boot Options Menu) and Option 10 (Boot Audit on Failure) are designed to assist in troubleshooting boot issues. Option 9 allows access to advanced boot options, which can help in diagnosing and resolving problems during the boot process. Option 10 enables logging of boot failures, providing insights into what went wrong during the boot sequence.

However, if a boot failure occurs even after enabling these options, it indicates a more severe issue, potentially related to the signed policy or other system configurations. In such cases, the system may not be able to boot due to the enforcement of the WDAC policy, which can lead to a boot failure or blue screen.

For recovery, you can attempt the following supported options:

Use Recovery Media: Boot from a Windows installation or recovery media to access recovery options. This can allow you to repair the installation or restore previous settings.
Safe Mode: If accessible, boot into Safe Mode to troubleshoot and potentially disable the problematic policy.
Command Prompt: Use the command prompt from recovery options to execute commands that may help in restoring boot functionality, such as rebuilding the Boot Configuration Data (BCD).

If these options do not resolve the issue, further investigation into the signed policy and its compatibility with the system's firmware may be necessary.

References: