Exclude trusted tools from XML and CSV exports.
How to use
- Find each remote tool your team uses, then tick Exclude.
- Download the XML and deploy it as a WDAC policy, e.g. through Intune.
- Optional: turn on Include IOC exports and import every CSV batch into Defender indicators.
- Pilot on one test device before a wider rollout.
Loading policy...
Tools
0 excludedExclude
No matching tools.
Downloads
WDAC policy
XMLBlocks execution on Windows 11 24H2 and newer.
0 rules kept · 0 removed
Policy notes
Removes selected filename/folder deny rules and references. Preserves policy IDs, settings and other rules.
No allow rules added. Other policies may still block execution. Validate with WDAC tooling; coverage varies by version and path.
Defender IOCs
CSVBlocks domains and IPs on Windows and macOS.
Import all batches. 500-row limit.
Import notes
No Allow indicators added. Delete existing imports separately. Other network controls may still block connections; endpoint coverage is incomplete.