Azure Local - How to disable WDAC policy

22 Jul, 2026

I was going to write a very comprehensive guide on how to disable Windows Defender Application Control (WDAC) policy on Azure Local, but I found this article that does that already: Manage Application Control for Azure Local

I do want to highlight a few things though 😊

CAUTION

Make sure to only disable WDAC policy when absolutely necessary and re-enable it as soon as possible.

More importantly, this is not really meant to be used on production systems. But if you are testing something, and WDAC policy is preventing you from doing so, this might be a good temporary solution to at least validate that the piece of software you are testing works as expected.

You would think that enabling/disabling WDAC policy would be done with a Set cmdlet, given that to see the policy you run Get-AsWdacPolicyMode for the cluster or Get-ASLocalWDACPolicyMode for a single node. Unfortunately, there is no Set cmdlet for this. Instead, you need to use the Enable-ASLocalWDACPolicy -Mode <Audit | Enforced> for a single node or Enable-AsWdacPolicy -Mode <Audit | Enforced> for a cluster.

How to check what policy mode is currently active

CAUTION

You will need to create the PowerShell remote session with CredSSP to run this command, otherwise it will look like this:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
Get-AsWdacPolicyMode
VERBOSE: Getting AppControl Policy Mode on Node01
WARNING: Unable to determine the policy mode on Node01. Check if Node01 is reachable or if CredSSP is provided to run Get-ASAppControlPolicyMode.
VERBOSE: Getting AppControl Policy Mode on Node02
WARNING: Unable to determine the policy mode on Node02. Check if Node02 is reachable or if CredSSP is provided to run Get-ASAppControlPolicyMode.
VERBOSE: Getting AppControl Policy Mode on Node03
WARNING: Unable to determine the policy mode on Node03. Check if Node03 is reachable or if CredSSP is provided to run Get-ASAppControlPolicyMode.
VERBOSE: Getting AppControl Policy Mode on Node04
WARNING: Unable to determine the policy mode on Node04. Check if Node04 is reachable or if CredSSP is provided to run Get-ASAppControlPolicyMode.

NodeName       PolicyMode
--------       ----------
Node01         Unable to determine
Node02         Unable to determine
Node03         Unable to determine
Node04         Unable to determine

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Check current WDAC policy mode

$PolicyMode = Invoke-Command -Session $Session -ScriptBlock {

    $Nodes = Get-ClusterNode

    foreach ($Node in $Nodes) {

        $Mode = Invoke-Command -ComputerName $Node.Name -ScriptBlock {

            return Get-ASLocalWDACPolicyMode

        }

        [PSCustomObject]@{

            NodeName   = $Node.Name
            PolicyMode = switch ($Mode) {

                0 { 'Not Configured' }
                1 { 'Audit' }
                2 { 'Enforced' }
                default { "Unknown ($Mode)" }

            }

        }

    }

}

$PolicyMode | Select-Object -Property NodeName, PolicyMode

#endregion

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Check current WDAC policy mode

$PolicyMode = Invoke-Command -Session $Session -ScriptBlock {

    return Get-AsWdacPolicyMode

}

$PolicyMode | Select-Object -Property NodeName, PolicyMode

#endregion

Sample output

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
VERBOSE: Getting AppControl Policy Mode on Node01
VERBOSE: AppControl Policy Mode on Node01 is Enforced.
VERBOSE: Getting AppControl Policy Mode on Node02
VERBOSE: AppControl Policy Mode on Node02 is Enforced.
VERBOSE: Getting AppControl Policy Mode on Node03
VERBOSE: AppControl Policy Mode on Node03 is Enforced.
VERBOSE: Getting AppControl Policy Mode on Node04
VERBOSE: AppControl Policy Mode on Node04 is Enforced.
NodeName       PolicyMode
--------       ----------
Node01         Enforced
Node02         Enforced
Node03         Enforced
Node04         Enforced

How to disable WDAC policy

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Disable WDAC for all nodes

Invoke-Command -Session $Session -ScriptBlock {

    $Nodes = Get-ClusterNode

    foreach ($Node in $Nodes) {

        Invoke-Command -ComputerName $Node.Name -ScriptBlock {

            Enable-ASLocalWDACPolicy -Mode Audit

        }

    }

}

#endregion

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Disable WDAC for all nodes

Invoke-Command -Session $Session -ScriptBlock {

    Enable-AsWdacPolicy -Mode Audit

}

#endregion

How to enable WDAC policy

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Disable WDAC for all nodes

Invoke-Command -Session $Session -ScriptBlock {

    $Nodes = Get-ClusterNode

    foreach ($Node in $Nodes) {

        Invoke-Command -ComputerName $Node.Name -ScriptBlock {

            Enable-ASLocalWDACPolicy -Mode Enforced

        }

    }

}

#endregion

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Disable WDAC for all nodes

Invoke-Command -Session $Session -ScriptBlock {

    Enable-AsWdacPolicy -Mode Enforced

}

#endregion

Find out what policy is currently used

NOTE

Get-ASLocalWDACPolicyInfo returns the same information as Get-ASLocalAppControlPolicyInfo because of this:

1
2
3
Get-Command -Name Get-ASLocalAppControlPolicyInfo | Select-Object -ExpandProperty Definition

Get-ASLocalWDACPolicyInfo

Meaning this is just an alias for the same command, without actually using the alias functionality. It is just a wrapper that calls the other cmdlet.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
#region Connect to cluster

$SeedNode = "YOUR_SEED_NODE_NAME_FQDN" # e.g. "Node01.domain.com"

$Session = New-PSSession -ComputerName $SeedNode -Credential (Get-Credential) -Authentication CredSSP

#endregion

#region Check current WDAC policy mode

Invoke-Command -Session $Session -ScriptBlock {

    return Get-ASLocalWDACPolicyInfo

}

#endregion

Sample policy info ouptut

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
VERBOSE: AppControl Policy Mode on Node01 is Enforced.
VERBOSE: AppControl Policy Mode on Node02 is Enforced.
VERBOSE: AppControl Policy Mode on Node03 is Enforced.
VERBOSE: AppControl Policy Mode on Node04 is Enforced.


NodeName          : Node01
PolicyMode        : Enforced
PolicyGuid        : {26CEAE53-BF9B-4207-9614-CB2C201C6186}
PolicyName        : AS_Base_Policy
PolicyVersion     : 1.x.x.x
Status            : Active
PolicyScope       : Kernel & User
MicrosoftProvided : True
IsSigned          : True

NodeName          : Node01
PolicyMode        : Enforced
PolicyGuid        : {66EA728D-7748-43F1-B39C-F51E8DAD11FA}
PolicyName        : AzCli_Supplemental_Policy
PolicyVersion     : 3.x.xx.xx
Status            : Active
PolicyScope       : Kernel & User
MicrosoftProvided : True
IsSigned          : True

NodeName          : Node01
PolicyMode        : Enforced
PolicyGuid        : {8AD4FA44-3589-4709-AFEA-259ABCB9C791}
PolicyName        : Azure_MSPKI_Supplemental_Policy
PolicyVersion     : 1.x.x.x
Status            : Active
PolicyScope       : Kernel & User
MicrosoftProvided : False
IsSigned          : False

NodeName          : Node01
PolicyMode        : Enforced
PolicyGuid        : {79CE16DE-3303-4591-8B06-EDD9CB53C999}
PolicyName        : SBE supplemental policy
PolicyVersion     : xx.xx.xx.xx
Status            : Active
PolicyScope       : Kernel & User
MicrosoftProvided : True
IsSigned          : False

Other cmdlets in the Microsoft.AS.Infra.Security.WDAC module

How to get the module

1
2
3
4
5
Get-Command -Name Get-AsWdacPolicyMode

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Get-ASWDACPolicyMode                               0.0        Microsoft.AS.Infra.Security.WDAC

Get the module details

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
$ModuleUsed = (Get-Command -Name Get-AsWdacPolicyMode).Source

Get-Module -Name $ModuleUsed | Select-Object -Property Name, Path, Version, ModuleBase, ExportedCommands

Name             : Microsoft.AS.Infra.Security.WDAC
Path             : C:\Program Files\WindowsPowerShell\Modules\Microsoft.AS.Infra.Security.WDAC\Microsoft.AS.Infra.Security.WDAC.psm1
Version          : 0.0
ModuleBase       : C:\Program Files\WindowsPowerShell\Modules\Microsoft.AS.Infra.Security.WDAC
ExportedCommands : {[Add-ASLocalWDACSupplementalPolicy, Add-ASLocalWDACSupplementalPolicy], [Add-ASWDACSupplementalPolicy,
                   Add-ASWDACSupplementalPolicy], [Enable-ASLocalWDACPolicy, Enable-ASLocalWDACPolicy], [Enable-ASWDACPolicy, Enable-ASWDACPolicy]...}

Get other cmdlets in this module

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
$ModuleUsed = (Get-Command -Name Get-AsWdacPolicyMode).Source
$ExportedCommands = (Get-Module -Name $ModuleUsed | Select-Object -ExpandProperty ExportedCommands).Keys
$ExportedCommands
Add-ASLocalWDACSupplementalPolicy
Add-ASWDACSupplementalPolicy
Enable-ASLocalWDACPolicy
Enable-ASWDACPolicy
Get-ASLocalWDACPolicyInfo
Get-ASLocalWDACPolicyMode
Get-ASWDACPolicyMode
Invoke-WDACRefreshPolicyTool
Remove-ASLocalWDACSupplementalPolicy
Remove-ASWDACSupplementalPolicy
Add-ASAppControlSupplementalPolicy
Add-ASLocalAppControlSupplementalPolicy
Enable-ASAppControlPolicy
Enable-ASLocalAppControlPolicy
Get-ASAppControlPolicyMode
Get-ASLocalAppControlPolicyInfo
Get-ASLocalAppControlPolicyMode
Invoke-AppControlRefreshPolicyTool
Remove-ASAppControlSupplementalPolicy
Remove-ASLocalAppControlSupplementalPolicy

Useful links

<< Previous Post

Next Post >>

#Blog #PowerShell #Azure Local #WDAC