Windows Components › Microsoft Defender Antivirus › Device Control
Define device control policy rules
Supported on SUPPORTED_Windows10 (defined in the Windows templates)
What it does
Please follow the device control policy rules xml schema to fill out the policy rules data.
What it writes
- Hive
- HKEY_LOCAL_MACHINE
- Registry key
Software\Policies\Microsoft\Windows Defender\Device Control\Policy Rules
Why it needs changes for Intune
- Policy references a Windows supportedOn definition.
- ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE
In Intune
No native CSP; import the ADMX (needs changes first).
From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.
Options
| Option | Type | Registry value | Allowed values |
|---|---|---|---|
| Define the policy rules hereRequired | Text | PolicyRules |
Up to 255 characters |
Configure and deploy
Choose a state and the option values; the output below is generated from the template for exactly that.
Fix the highlighted options to generate output.
History 2 retained releases
- 22H2 · 1.015 Jul 2024
- Added in this release.
Template
- Internal name
DeviceControl_PolicyRules- Namespace
Microsoft.Policies.WindowsDefender- Template file
WindowsDefender.admx- Release
- Windows 10 22H2 · 1.0 · file set
bc15f6a5271783ee…
Definition, editor controls and support
Definition
<policy class="Machine" displayName="$(string.DeviceControl_PolicyRules)" explainText="$(string.DeviceControl_PolicyRules_Explain)" key="Software\Policies\Microsoft\Windows Defender\Device Control\Policy Rules" name="DeviceControl_PolicyRules" presentation="$(presentation.DeviceControl_PolicyRules)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<parentCategory ref="Microsoft.Policies.WindowsDefender:DeviceControl" />
<supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows10" />
<elements>
<text id="DeviceControl_PolicyRules" required="true" valueName="PolicyRules" />
</elements>
</policy>Editor controls
<presentation id="DeviceControl_PolicyRules" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<textBox refId="DeviceControl_PolicyRules">
<label>Define the policy rules here</label>
</textBox>
</presentation>Supported platforms and category
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.WindowsDefender:category:AntiSpywareDefender
<category displayName="$(string.AntiSpywareDefender)" name="AntiSpywareDefender" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
</category>
Microsoft.Policies.WindowsDefender:category:DeviceControl
<category displayName="$(string.DeviceControl)" name="DeviceControl" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<parentCategory ref="Microsoft.Policies.WindowsDefender:AntiSpywareDefender" />
</category>
Microsoft.Policies.WindowsDefender:unresolved:Microsoft.Policies.Windows:SUPPORTED_Windows10
<unresolved reference="Microsoft.Policies.Windows:SUPPORTED_Windows10" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>
Microsoft.Policies.WindowsDefender:category:AntiSpywareDefender
<category displayName="$(string.AntiSpywareDefender)" name="AntiSpywareDefender" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
</category>
<strings><string id="Microsoft.Policies.WindowsDefender:AntiSpywareDefender">Microsoft Defender Antivirus</string></strings>
Microsoft.Policies.WindowsDefender:category:DeviceControl
<category displayName="$(string.DeviceControl)" name="DeviceControl" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<parentCategory ref="Microsoft.Policies.WindowsDefender:AntiSpywareDefender" />
</category>
<strings><string id="Microsoft.Policies.WindowsDefender:DeviceControl">Device Control</string></strings>