How do we fix managed installer rules when WDAC blocks trusted ConfigMgr apps ?

Patel Krishna 40 Reputation points
2026-09-15T01:54:45.0266667+00:00

WDAC rules meant to trust configuration manager installs are failing, blocking approved deployments. How can we fix Managed Installer tracking and restore proper authorization ?

Windows for business | Windows 365 Business
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 43,565 Reputation points Independent Advisor
    2026-09-15T02:34:41.1466667+00:00

    Hi Patel Krishna,

    your Configuration Manager deployments are failing because WDAC is not recognizing them as trusted. This happens because WDAC's Managed Installer feature does not track files natively, it relies completely on the Windows Application Identity service and a companion AppLocker policy to apply origin tags to files as they are written to the disk. If either of these components is misconfigured or offline, the files will lack the necessary authorization tags and will be aggressively blocked by the WDAC enforcement engine.

    To restore tracking and authorization, you must satisfy these underlying requirements on the client endpoints. Open the services.msc console, locate the Application Identity service, and ensure it is configured to start automatically and is actively running. Furthermore, you must verify that an AppLocker policy is deployed to these machines with the Managed Installer rule collection enabled, explicitly trusting your Configuration Manager processes. Once the service is active and the tracking policy is applied, newly deployed applications will receive the correct cryptographic tags and execute without violating your WDAC rules.

    Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

    VPHAN

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-15T01:55:05.39+00:00

    Use this end-to-end check path to restore Managed Installer authorization for Configuration Manager deployments:

    1. Confirm the WDAC policy has Enabled: Managed Installer turned on.
      • Managed Installer trust only works when the App Control policy includes that option.
      • In policy creation, this is Option 13 with Set-RuleOption.
    2. Verify AppLocker is configured for Managed Installer.
      • Managed Installer depends on AppLocker, not WDAC alone.
      • The AppLocker policy must:
        • define Managed Installer rules
        • include rule collections for EXE, DLL, and MANAGEDINSTALLER
        • enable services enforcement for executables and DLLs
      • Only EXE file types can be designated as managed installers.
    3. Check the required AppLocker services.
      • From an elevated PowerShell window, confirm both services are running:
        • appidsvc
        • AppLockerFltr
      • If they are not running, start them and recheck.
    4. Validate that AppLocker policy files were created.
      • Check %windir%\System32\AppLocker for AppLocker tracking files.
      • At minimum, there should be a .AppLocker file for each of these rule collections:
        • EXE
        • DLL
        • MANAGEDINSTALLER
      • If those files are missing, the AppLocker policy likely was not applied correctly.
    5. Export and inspect the effective AppLocker policy.
      • Run: 
             Get-AppLockerPolicy -Effective -XML > $env:USERPROFILE\Desktop\AppLocker.xml
      • Open the XML and confirm it contains the expected rules.
      • Specifically verify:
        • at least one rule exists in each of EXE, DLL, and MANAGEDINSTALLER RuleCollections
        • EXE and DLL RuleCollections include the required RuleCollectionExtensions configuration
        • the Managed Installer rule actually matches the Configuration Manager installer process being used
    6. If using Configuration Manager, make sure it was enabled as a managed installer correctly.
      • Configuration Manager automatically configures itself as a managed installer and enables the required AppLocker components if one of its inbox App Control policies is deployed.
      • If Configuration Manager was configured by another method, additional setup is required:
        • use the ManagedInstaller command-line switch in ccmsetup.exe, or
        • deploy one of the Configuration Manager inbox audit mode policies alongside the custom policy
    7. Check AppLocker event behavior for the managed installer process.
      • Restart the managed installer process.
      • In AppLocker - EXE and DLL event log, look for event 8002 with PolicyName = MANAGEDINSTALLER.
      • If 8003 or 8004 appears instead with PolicyName = MANAGEDINSTALLER, the Managed Installer rule in the AppLocker XML is not matching the process correctly.
    8. Verify the deployed files were tagged with managed installer origin.
      • Use fsutil.exe to query the extended attributes on files written by the managed installer process.
      • If the managed installer origin attribute is missing, redeploy the files through the managed installer and test again.
    9. Isolate whether the issue is specific to one installer path.
      • Test deployment of a different app through the same managed installer.
      • If needed, add another managed installer to the AppLocker policy and test installation through that second installer.
    10. If the device has no existing AppLocker policy, expect extra warning events.
    • Applying the managed installer AppLocker policy on such devices can generate a large increase in warnings in the AppLocker - EXE and DLL log. That can add noise, but it does not by itself mean Managed Installer is broken.

    If the immediate goal is to restore trust for approved ConfigMgr apps, the most common fixes are:

    • enable Managed Installer in the WDAC policy
    • ensure AppLocker has valid EXE/DLL/MANAGEDINSTALLER rule collections
    • confirm appidsvc and AppLockerFltr are running
    • verify the Managed Installer AppLocker rule matches the actual Configuration Manager installer process
    • ensure Configuration Manager was onboarded as a managed installer using an inbox App Control policy or the ManagedInstaller ccmsetup.exe switch
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.