Fix STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT 0XC0000361

You're trying to run an app—maybe a portable tool you downloaded, a self-contained executable, or an installer from a vendor you trust—and boom: STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT (0XC0000361). You click the shortcut again, same result. This error is infuriating because it gives you no hint about which policy is responsible. I've seen this most often on corporate-managed Windows 10/11 machines after a security update or when IT pushes a new AppLocker or Windows Defender Application Control (WDAC) policy.

What Actually Causes This Error?

Under the hood, Windows has two main security features that can trigger this exact code: AppLocker and Windows Defender Application Control (WDAC). Both are designed to block untrusted or non-approved executables, scripts, and installers. The distinction between them is important for your fix.

• AppLocker is the older policy engine. It uses rules about publishers, paths, or file hashes. You'll see it in Group Policy and Local Security Policy.
• WDAC is the newer, more strict option. It's often called "Device Guard" or "Code Integrity." It can block any binary that isn't signed by a trusted certificate or Microsoft.

Your exact trigger varies, but common scenarios include:

• Running a portable app from a network drive or USB stick
• Double-clicking a freshly downloaded installer (especially unsigned or self-signed)
• Launching a script (.ps1, .vbs, .cmd) that runs an executable

The error code 0xC0000361 specifically says "the default policy prevented access." That means no explicit rule allowed the file—Windows fell back to the default block.

Step-by-Step Fix: Identify and Remove the Block

Step 1: Find the Blocking Policy in Event Viewer

Skip guessing. Go straight to the logs.

1. Press Win + R, type eventvwr.msc, and hit Enter.
2. Expand Windows Logs > Security.
3. On the right, click Filter Current Log.
4. For Event IDs, type 3076 (AppLocker) and 3033 (WDAC/Code Integrity), separated by commas. Click OK.

Look for events that match the time you tried to run the blocked app. An event with ID 3076 will tell you the AppLocker rule that blocked it. One with ID 3033 means WDAC/Code Integrity blocked it. Note the file path and rule name.

Step 2: Disable the Blocking Policy

Here's where the fix splits depending on what you found.

If AppLocker is the culprit (Event ID 3076)

1. Press Win + R, type secpol.msc, and hit Enter.
2. Go to Security Settings > Application Control Policies > AppLocker.
3. Right-click Executable Rules and choose Create Default Rules (if they're missing). Then check the rule that blocked your app—likely a Path Rule or Publisher Rule with a condition like "Deny."
4. Right-click the blocking rule and select Delete or Disable.
5. Run gpupdate /force in an admin Command Prompt.

If WDAC/Code Integrity is the culprit (Event ID 3033)

This one's trickier because WDAC policies are often managed via Group Policy or MDM. You can't just click to remove them from secpol.msc. Here's the workaround:

1. Open an elevated Command Prompt (right-click, Run as Administrator).
2. Check if WDAC is enforced with: Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard. Look for CodeIntegrityPolicyEnforcementStatus — if it says 2 (Enforced), that's your block.
3. To disable WDAC temporarily, run: reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled /t REG_DWORD /d 0 /f.
4. Restart the machine. This turns off WDAC enforcement until the next group policy refresh (usually every 90 minutes).

Note: On a personal machine, you can permanently disable WDAC by removing the policy via Group Policy Editor (gpedit.msc) under Computer Configuration > Administrative Templates > System > Device Guard. Set Turn On Virtualization Based Security to Disabled.

Step 3: Add an AppLocker Exception Instead (Recommended)

Rather than disabling an entire policy, add an explicit allow rule for the blocked file. This keeps you secure.

1. In secpol.msc, go to AppLocker > Executable Rules.
2. Right-click empty space, choose Create New Rule.
3. Select Allow and click Next.
4. Choose Publisher (if the file is signed) or Path (if it's from a trusted folder). For Path, specify the exact file or folder location.
5. Finish the wizard. Run gpupdate /force.

What If It Still Fails?

Sometimes the block comes from a higher-level policy like Software Restriction Policies (SRP) or a custom WDAC policy pushed via Intune. Here's how to dig deeper:

• Check SRP: Open secpol.msc and look under Security Settings > Software Restriction Policies. If you see a Security Levels setting set to Disallowed by default, that's your problem. Change it to Basic User or Unrestricted.
• Check for MDM policy: If you're on a company device, your IT admin likely pushed a WDAC policy via Intune. You can't override that locally—contact your help desk.
• Verify file integrity: A corrupted or tampered executable can also trigger this error. Re-download the file from a trusted source.

One last tip: if the app is a portable tool you use often, move it to C:\Program Files or C:\Windows (if you trust it). AppLocker often allows executables in those paths by default.

Hope that gets you running again. If not, check those event logs again—there's always a clue hiding in Event ID 3076 or 3033.