CodeIntegrity C:\Windows\System32\CodeIntegrity

C:\Windows\System32\CodeIntegrity: applied App Control (WDAC) policies (SiPolicy.p7b, CiPolicies\Active) and code integrity files.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

CodeIntegrity is the folder of code integrity, the feature that verifies the signatures of drivers and binaries. It is where Windows reads the App Control for Business (formerly WDAC) policies that are in force: SiPolicy.p7b for the single-policy format, and CiPolicies\Active for the multiple-policy format ({GUID}.cip files).

What it contains

SiPolicy.p7b: the single policy, if that format is used.
CiPolicies\Active\{GUID}.cip: the multiple policies, in binary format.
Copies of policies also exist on the EFI system partition.

Risks and best practices

Do not remove a policy by deleting its file. Follow Microsoft’s removal procedure, or boot can be blocked. On a recent system, CiTool.exe --remove-policy <GUID> does the job.
Deploy policies through GPO, MDM or CiTool, and test them in audit mode first.
To understand a block, read the Microsoft-Windows-CodeIntegrity/Operational log: event 3077 reports an enforced block, 3076 a block that an audit-mode policy would have made.
This folder is part of the security chain, so restrict write access to it.

Useful commands

# List the application control policy files present
Get-ChildItem -Force "$env:windir\System32\CodeIntegrity" -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

# List active policies with CiTool (Windows 11 and recent versions)
CiTool.exe --list-policies

# Enforced blocks (3077) and audit-mode would-be blocks (3076)
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-CodeIntegrity/Operational'; Id = 3076, 3077 } -MaxEvents 20 | Select-Object TimeCreated, Id, Message

Report a mistake