1 · Import policy XML
Paste your existing AppLocker policy, or load a file
No policy loaded yet. Paste XML above and hit Parse to table, Load sample to explore, or start a brand-new policy.
Paste or import an AppLocker policy XML and read every rule as a clean, sortable table. Add rules, beautify the XML, then export or copy a valid policy back into Group Policy or an Intune configuration profile.
No policy loaded yet. Paste XML above and hit Parse to table, Load sample to explore, or start a brand-new policy.
Everything runs in your browser — no policy XML is uploaded, there is no account, and refreshing the tab clears it. Export the effective policy from an endpoint with Get-AppLockerPolicy -Effective -Xml, or copy a <RuleCollection> value from your Intune AppLocker CSP, and paste it above.
All five AppLocker collections — Exe, Msi (Windows Installer), Script, Dll and Appx (packaged apps) — and all three condition types: Publisher, Path and File hash (SHA256). Exceptions and Msi/Appx collection extensions are preserved on round-trip.
Yes. The Export panel regenerates a schema-shaped AppLockerPolicy for Set-AppLockerPolicy or the Group Policy AppLocker node. For Intune, the Intune (OMA-URI) panel emits one custom setting per rule collection — the AppLocker CSP path ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/{Grouping}/{EXE|DLL|MSI|Script|StoreApps}/Policy, data type String, value the plain RuleCollection XML. You can also paste an OMA-URI RuleCollection value straight into the import box. Always test in Audit only first.
No. Parsing, editing and export all happen in your browser. No account, no API call, nothing stored — refreshing the tab clears it.
Blocks live in the Windows event logs, not the policy. Use the companion Get-AppLockerBlocks.ps1 script per device, or the Advanced Hunting KQL query fleet-wide via Microsoft Defender for Endpoint.
Carve-outs that exclude files from this rule — e.g. allow %WINDIR%\* except %WINDIR%\Temp\*.