What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For the strongest practical protection, use the controls together: keep Microsoft Defender Antivirus active, pilot relevant Attack Surface Reduction (ASR) rules, and use App Control for Business when you need to decide which code is trusted on managed devices. PowerShell execution policy can reduce accidental runs of some downloaded scripts, but Microsoft describes it as a safety feature—not a security boundary.
These controls do different jobs. Defender scans for malware and ASR targets selected risky behavior; App Control enforces a trust policy across applications and scripts; execution policy governs certain conditions for loading PowerShell scripts. Choosing the right combination depends on how tightly you need to control software and how much compatibility testing you can do.
As an Amazon Associate I earn from qualifying purchases.
How the three controls differ
| Control | Protection mechanism and coverage | Policy granularity and best fit | Operational effort, compatibility, and audit |
|---|---|---|---|
| Microsoft Defender Antivirus and ASR | Antimalware inspection plus rules aimed at specific risky behaviors. One relevant rule is “Block execution of potentially obfuscated scripts.” Microsoft’s ASR rules overview describes the available rules. | Target particular behaviors rather than allowlisting every script. Useful as a malware and behavior-based layer. | Choose rules relevant to your environment. Microsoft recommends audit testing for rules outside its standard protection set before moving them to Warn or Block. Review compatibility and exclusions carefully. ASR rules overview |
| App Control for Business | Windows code policy governs trusted applications and scripts. PowerShell can constrain unapproved content or block it under the appropriate configuration. Microsoft’s script-enforcement guidance explains host-specific behavior. | Best suited to managed devices where administrators need to control which applications and scripts are allowed, not merely detect known malware. | Requires policy design and compatibility checks. Behavior varies by script host, and audit mode can still affect some hosts. App Control complements antivirus; it does not replace it. Microsoft’s App Control overview |
| PowerShell execution policy | Sets conditions for loading PowerShell configuration files and running scripts. With RemoteSigned, downloaded files marked as coming from the internet must be signed. | A useful administrative default to reduce accidental execution of some downloaded unsigned scripts. It is not an allowlist of trusted code. | Limited protection: local scripts can run unsigned, and some download methods do not mark files with the internet zone. Microsoft says execution policy is a safety feature, not a security boundary. about_Execution_Policies |
In practical terms, execution policy is the lightest control, ASR adds targeted behavior blocking, and App Control can impose the strongest trust restrictions. They are not interchangeable, and none makes the others redundant.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What each control can—and cannot—stop
Defender Antivirus and ASR: detect malware and block selected behavior
Defender Antivirus inspects content for malware. ASR adds rules that can block particular attack techniques, including execution of potentially obfuscated scripts. That rule is not a universal script allowlist: it targets a defined behavior, rather than deciding that every script must be approved before it can run. Microsoft’s ASR documentation
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
PowerShell also integrates with the Antimalware Scan Interface (AMSI). On Windows 10 and later, Windows PowerShell 5.1 passes script blocks to AMSI; PowerShell 7.3 expanded the AMSI data to include .NET method invocations. AMSI is a scanning integration, not a substitute for a code-approval policy. Microsoft’s PowerShell security-features documentation
App Control: enforce a trust policy for scripts
App Control for Business can apply code policies to scripts and PowerShell. When PowerShell files are permitted by policy, they can run with Full Language rights. Files that are not approved may be run in Constrained Language Mode rather than being entirely stopped; with the relevant configuration, such as BlockScriptOnPolicyFailure, policy failures can instead block scripts. The outcome therefore depends on policy configuration, not simply on whether App Control is present. Microsoft’s PowerShell App Control guidance
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Script enforcement is host-specific. Microsoft documents that some hosts may behave differently even when policy is in audit mode; with script enforcement active, MSHTA and MSXML execution can be blocked. Test the actual hosts and workflows in use rather than assuming that one PowerShell test covers every script path. Microsoft’s script-enforcement guidance
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Execution policy: reduce a narrow class of accidental runs
RemoteSigned can require a signature for downloaded scripts that carry an internet-zone marker, while allowing locally written scripts to run unsigned. That marker is not guaranteed: some ways of downloading a file do not add it. A user who can run code through another route is not meaningfully contained by execution policy alone. Treat it as a guardrail for script-loading conditions, not as malware prevention or an adversary-resistant barrier. Microsoft’s execution-policy documentation
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Roll out script protection on managed Windows devices
- Inventory what must keep working. Record required scripts, modules, PowerShell versions, scheduled tasks, management agents, and other script hosts. Include dependencies and module exports in the inventory; an allow policy that misses a required component can disrupt a workflow.
- Pilot relevant ASR rules. Select rules based on your organization’s risks and workflows. For rules outside Microsoft’s standard protection set, collect Audit-mode data before considering Warn or Block. Investigate events and likely line-of-business conflicts, and be cautious with exclusions. Microsoft’s ASR rules overview
- Design and audit the App Control policy. Allow the files and modules your users and services need, then examine what would be constrained or blocked. Do not assume audit mode is behaviorally neutral: some script hosts can change behavior during an audit. Microsoft’s script-enforcement guidance
- Review PowerShell audit events where supported. PowerShell 7.4 and later supports App Control audit logging. Enable the
PowerShellCore/Analyticlog to review those events; it is not enabled by default and can grow quickly, so disable it after the audit period. Microsoft’s PowerShell App Control guidance - Validate all affected hosts and workflows. Test scheduled jobs, management tooling, business scripts, and non-PowerShell hosts that policy may affect. Resolve required-script failures before broad enforcement.
- Enforce gradually and retain antivirus. Move from audit findings to deliberate policy enforcement in stages, monitoring for required code that was missed. Keep an active antivirus solution alongside App Control: Microsoft states, “Although application control can significantly harden your computers against malicious code, it’s not a replacement for antivirus.” Microsoft Learn, “Application Control for Windows”
Version and Windows scope to check
- Microsoft’s App Control script-enforcement guidance covers Windows 10, Windows 11, and listed Windows Server releases including Server 2016 through Server 2025. Policy capabilities vary by Windows release, so confirm that the specific capability you plan to use is supported on the target systems. Script enforcement with App Control for Business
- The PowerShell
FileOnlyEntrysetting is documented for PowerShell 7.6.6 and newer. It blocks command-string, encoded-command, pipeline, and interactive execution paths, limiting PowerShell to scripts invoked with-File. Verify the installed PowerShell version before relying on it. How to use App Control to secure PowerShell - PowerShell 7.4 introduced App Control audit support; reviewing its events requires enabling the
PowerShellCore/Analyticlog. How to use App Control to secure PowerShell
Which approach should you choose?
- For a baseline on a Windows PC: keep Defender Antivirus active and use execution policy as an administrative safety setting, while understanding its limits.
- To block selected script-related attack behaviors: evaluate the relevant ASR rules and pilot them before enforcement where Microsoft recommends audit testing.
- To restrict what code can run on managed devices: design App Control policies around the scripts and modules the organization actually needs, then audit and validate host compatibility before enforcement.
- For a stronger layered setup: combine App Control with active antivirus and relevant ASR rules; use execution policy only as an additional guardrail.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
