Skip to content
AdminExplorer documentation

Policy guide with example configurations

Applies to client 2.0.x and later. For tenant admins.

Your policy has four parts: approved applications, rules (Enterprise), denied paths and settings. You edit them under Policy and Settings; every save reaches enrolled devices with the next policy pull (every 15 minutes, or at once with Sync now on the device).

The examples below are the policy exactly as the portal stores it (policy version 2, the body of PUT /v1/tenants/{tenantId}/policy). In the portal you enter the same values in the Policy editor and on the Settings page. Every example on this page is checked automatically against the same validation the editor uses.

Approved applications

Section titled “Approved applications”

An approved application is a program your users may run with administrator rights.

Field Meaning
Name Unique key of the entry, 1 to 128 characters, no backslash and no leading or trailing space; case-insensitive
Path Absolute path such as C:\Program Files\Contoso\Tool\tool.exe, no wildcards
Arguments Arguments the AdminExplorer menu starts the program with
SHA-256 Optional: pins the exact file; another version is refused (HashMismatch)
Friendly name The name shown in the tray menu
Enabled Off makes the entry inert in both flows
Allow child elevation Enterprise: direct children of the program are elevated too
Show in the AdminExplorer menu Off hides it from the tray menu; it still works from right-click and normal starts
Menu category A one-level submenu such as Tools; empty = top level

A simple entry, shown in the tray menu under Tools:

{
  "name": "Contoso Label Printer",
  "dataPath": "C:\\Program Files\\Contoso\\Label Printer\\LabelSetup.exe",
  "arguments": "",
  "hashSha": "",
  "friendlyName": "Label printer setup",
  "globalApplication": true,
  "allowChildElevation": false,
  "showInMenu": true,
  "menuCategory": "Tools",
  "assignedGroups": []
}

The same program pinned to one exact file, hidden from the menu (it still starts elevated when the user opens it). Replace the hash with the real SHA-256 of your file, for example from Get-FileHash:

{
  "name": "Contoso Label Printer pinned",
  "dataPath": "C:\\Program Files\\Contoso\\Label Printer\\LabelSetup.exe",
  "arguments": "/config",
  "hashSha": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "friendlyName": "Label printer setup",
  "globalApplication": true,
  "allowChildElevation": false,
  "showInMenu": false,
  "menuCategory": "",
  "assignedGroups": []
}

Things to know:

  • Pre-approved programs match by prefix. A path is also matched as a folder prefix when the program is started normally: C:\Program Files\Contoso would elevate every program under it. The editor warns when a path does not end in .exe or has fewer than three backslashes (the device logs event 2010).
  • Paths off the system drive: an entry on another drive without a SHA-256 works, but the editor warns and the device logs event 2011. Add the hash to pin the file.
  • Scripts and installers: .ps1 and .msi entries always go through the on-demand flow with the reason prompt and, with Manual approval, the approval queue. The PowerShell execution policy setting decides how approved .ps1 files run.
  • Menu: top-level entries first (by friendly name), then one submenu per category. Categories are grouped case-insensitively; the menu uses the first spelling it sees.
  • Changes to the approved list reach the pre-approved (automatic) flow when the device’s service restarts; the device schedules that restart itself when it is idle, at the latest at 03:00 local time. Sync now applies them at once.

Rules (Enterprise)

Section titled “Rules (Enterprise)”

Rules match on-demand requests for files that are not on the approved list. They are ignored on Standard. Rules are sorted by name; the first match decides, so prefix names with numbers such as 10- and 20-.

Type Matches Notes
Path An absolute pattern with * and ?, for example C:\Program Files\Contoso Tools\* System drive only. A pattern without a folder below the drive root (such as C:\*) matches everything and is logged as 2010
Publisher The leaf signer certificate’s common name, for example Contoso Software Ltd Signature checked on the file itself or its catalog; works on any local drive
Hash The SHA-256 of one file Works on any local drive

Each rule can be limited to kinds (exe, ps1, msi; none selected = all three), can carry an extra SHA-256, and can allow child elevation.

A path rule for a folder only administrators can write to:

{
  "name": "20-Contoso Tools",
  "type": "Path",
  "pattern": "C:\\Program Files\\Contoso Tools\\*",
  "publisher": "",
  "hashSha": "",
  "kinds": ["exe"],
  "allowChildElevation": false,
  "assignedGroups": []
}

A publisher rule that allows installer packages (.msi only) signed by one specific vendor:

{
  "name": "10-Contoso installers",
  "type": "Publisher",
  "pattern": "",
  "publisher": "Contoso Software Ltd",
  "hashSha": "",
  "kinds": ["msi"],
  "allowChildElevation": false,
  "assignedGroups": []
}

Keep publisher rules narrow. A publisher rule allows every file that publisher signs, wherever it is on a local drive. A rule for a large publisher such as Microsoft would let users elevate a great many system programs, shells and administration tools among them, and is effectively administrator rights on request. Never write publisher rules for operating system or platform vendors. Use them only for a specific vendor’s signer, limit them to the kinds you need (for example msi only), and prefer a path rule for a program installed per machine under C:\Program Files. A rule has one type: a publisher rule cannot also carry a path pattern, but it can carry a SHA-256 to pin one exact file.

A hash rule for one specific file (replace the hash):

{
  "name": "30-Vendor updater",
  "type": "Hash",
  "pattern": "",
  "publisher": "",
  "hashSha": "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210",
  "kinds": [],
  "allowChildElevation": false,
  "assignedGroups": []
}

Use path rules only for folders that standard users cannot write to. A path rule on a folder users can write to lets them elevate whatever they put there (the audit record flags such targets as “user-writable folder”).

Denied paths

Section titled “Denied paths”

Denied paths refuse on-demand requests before any entry or rule is considered. They do not stop a program on your pre-approved list that the user starts normally, so keep such programs out of folders you deny. The built-ins always apply on the system drive: C:\Users\*\Downloads\*, C:\Users\*\AppData\Local\Temp\* and C:\Windows\Temp\*. Add your own absolute patterns (one * or ? pattern per entry, no /, ; or ..). Denied paths do not apply to Run in sandbox.

{
  "version": 2,
  "settings": {
    "approvalMode": "Auto",
    "reasonRequired": true,
    "reasonMinLength": 2,
    "approvalTtlMinutes": 60,
    "powerShellExecutionPolicy": "Bypass"
  },
  "deniedPaths": [
    "C:\\Users\\*\\Desktop\\*",
    "C:\\Users\\Public\\*",
    "C:\\Windows\\System32\\cmd.exe"
  ],
  "applications": [],
  "rules": [],
  "tray": { "hideExit": true }
}

Settings

Section titled “Settings”
Setting Values Default
Approval mode Auto or Manual (Enterprise) Auto
Users must type a reason on or off on
Minimum reason length 1 to 1024 characters 2
Pending request lifetime 1 to 1440 minutes 60
PowerShell execution policy for approved .ps1 files Bypass, RemoteSigned or AllSigned Bypass
Hide Exit in the tray menu on or off on
Allow any application on demand Enterprise off
Installed software tracking on or off, plus system components and updates on
Entra group targeting Enterprise, needs Directory Sync off

Manual approval with a longer reason and signed scripts only:

{
  "approvalMode": "Manual",
  "reasonRequired": true,
  "reasonMinLength": 15,
  "approvalTtlMinutes": 240,
  "powerShellExecutionPolicy": "AllSigned"
}

The PowerShell setting decides the -ExecutionPolicy the service passes when it runs an approved script: Bypass runs any approved script, RemoteSigned refuses downloaded scripts that are not signed, AllSigned runs only signed scripts.

Starter policy: office

Section titled “Starter policy: office”

For an office where users need a few tools and installers, on Standard or Enterprise. Users give a reason, requests start at once, and shells stay out of reach. The editor notes that the .ps1 and .msi entries do not end in .exe; that is expected for scripts and installers, which always go through the on-demand flow.

{
  "version": 2,
  "settings": {
    "approvalMode": "Auto",
    "reasonRequired": true,
    "reasonMinLength": 10,
    "approvalTtlMinutes": 60,
    "powerShellExecutionPolicy": "RemoteSigned",
    "allowAnyApplicationOnDemand": false,
    "softwareInventory": { "enabled": true, "includeSystemComponents": false, "includeUpdates": false },
    "entraGroupTargeting": false
  },
  "deniedPaths": [
    "C:\\Users\\*\\Desktop\\*",
    "C:\\Users\\Public\\*"
  ],
  "applications": [
    {
      "name": "Label printer setup",
      "dataPath": "C:\\Program Files\\Contoso\\Label Printer\\LabelSetup.exe",
      "arguments": "",
      "hashSha": "",
      "friendlyName": "Label printer setup",
      "globalApplication": true,
      "allowChildElevation": false,
      "showInMenu": true,
      "menuCategory": "Tools",
      "assignedGroups": []
    },
    {
      "name": "Reset print spooler",
      "dataPath": "C:\\Program Files\\Contoso\\Scripts\\Reset-PrintSpooler.ps1",
      "arguments": "",
      "hashSha": "",
      "friendlyName": "Reset the print spooler",
      "globalApplication": true,
      "allowChildElevation": false,
      "showInMenu": true,
      "menuCategory": "Tools",
      "assignedGroups": []
    },
    {
      "name": "VPN client",
      "dataPath": "C:\\Program Files\\Contoso\\Installers\\VPNClient.msi",
      "arguments": "",
      "hashSha": "",
      "friendlyName": "Install the VPN client",
      "globalApplication": true,
      "allowChildElevation": false,
      "showInMenu": true,
      "menuCategory": "Installers",
      "assignedGroups": []
    }
  ],
  "rules": [],
  "tray": { "hideExit": true }
}

Starter policy: developers

Section titled “Starter policy: developers”

For an Enterprise tenant with developers who install tools: installer packages signed by one tools vendor and the programs that vendor installs per machine under C:\Program Files are allowed by rule, with a reason, and untrusted downloads can be tried in Windows Sandbox instead.

{
  "version": 2,
  "settings": {
    "approvalMode": "Auto",
    "reasonRequired": true,
    "reasonMinLength": 10,
    "approvalTtlMinutes": 60,
    "powerShellExecutionPolicy": "RemoteSigned",
    "allowAnyApplicationOnDemand": false,
    "sandbox": {
      "enabled": true,
      "offerWhenDenied": true,
      "networking": false,
      "clipboard": false,
      "vGpu": false,
      "audioInput": false,
      "videoInput": false,
      "printerRedirection": false,
      "maxMinutes": 120,
      "kinds": ["exe", "msi", "ps1"],
      "requireReason": true,
      "assignedGroups": [],
      "manageFeature": true
    },
    "softwareInventory": { "enabled": true, "includeSystemComponents": false, "includeUpdates": false },
    "entraGroupTargeting": false
  },
  "deniedPaths": [],
  "applications": [
    {
      "name": "Visual Studio Installer",
      "dataPath": "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\setup.exe",
      "arguments": "",
      "hashSha": "",
      "friendlyName": "Visual Studio Installer",
      "globalApplication": true,
      "allowChildElevation": true,
      "showInMenu": true,
      "menuCategory": "Developer",
      "assignedGroups": []
    }
  ],
  "rules": [
    {
      "name": "10-Contoso Dev Tools installers",
      "type": "Publisher",
      "pattern": "",
      "publisher": "Contoso Dev Tools Ltd",
      "hashSha": "",
      "kinds": ["msi"],
      "allowChildElevation": false,
      "assignedGroups": []
    },
    {
      "name": "20-Contoso Dev Tools programs",
      "type": "Path",
      "pattern": "C:\\Program Files\\Contoso Dev Tools\\*",
      "publisher": "",
      "hashSha": "",
      "kinds": ["exe", "ps1"],
      "allowChildElevation": false,
      "assignedGroups": []
    }
  ],
  "tray": { "hideExit": true }
}

Check the exact signer name of a file before you write a publisher rule: in File Explorer open the file’s Properties, Digital Signatures, and use the signer’s name as shown there. To limit rules like these to a team, assign Entra groups; see Entra group targeting.

Local entries and the Policies key

Section titled “Local entries and the Policies key”

The portal owns only the entries it wrote on the device. Entries created locally (by hand or by an older installer) are never changed; a portal entry with the same name as a local one is skipped. Values in the AdminExplorer key under HKLM\SOFTWARE\Policies (for example set by Group Policy) always win over the portal.

Section titled “Related guides”

AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.