AppLocker enable

Set-AppLockerPolicy -PolicyObject <policy>

Applies the AppLocker policy with Set-AppLockerPolicy, restricting which executables, scripts, and installers can run on the machine.

Run it when you want policy-based application control: AppLocker defines the rules for what can run (executables, scripts, installers, DLLs) by publisher, path, or hash — and Set-AppLockerPolicy applies the policy object to the machine. It's the countermeasure against attacker tool execution: the unsigned payload, the script in Temp, and downloaded binaries are blocked if they're not in the rules. In hardening, AppLocker (or WDAC) is the application control piece: the default policy allows Microsoft-signed and system path items, and blocks the rest. The policy is generated and tested before applying.

Don't apply it without a tested policy: a poorly designed policy blocks legitimate applications (your own unsigned software, installers, admin scripts) and breaks work — the policy is validated in the lab with audit-only mode (rules in Audit mode log without blocking) before enforcing. AppLocker has limits against advanced actors: legitimate signed binaries (living off the land) and path rule bypasses are documented — WDAC (Device Guard) is the stricter evolution for mature environments. And note: AppLocker doesn't cover everything executable (PowerShell can be loaded in alternative ways); combining with mitigations and auditing completes the picture.