ThreatLocker migration guide
Migrate From ThreatLocker Without Opening A Gap
Unknown code stays off the real system the whole way through. What goes away is the request queue: users stop waiting for approvals, and nobody has to maintain the allowlist.
Updated October 2026
Warden's performance record has been published every week since October 2020 from Xcitium Threat Labs data, including whether any contained activity reached operational impact.
What Changes For The People Running It
Most of the work ThreatLocker creates is policy work. This is who owns each piece before and after the move.
How Much Time Does The Queue Take Today?
Enter your own request volume. The result is the admin and user time that the approval queue consumes in a year, which is the time a migration would return. Every input is yours to set.
For the licence side, including a separate antivirus or EDR and the Warden managed service, use the cost model on Warden vs ThreatLocker.
Want A Plan Built Around Your Policy?
Send your endpoint count and which ThreatLocker modules you run. We send back a cutover plan and a control-by-control map for your estate.
How To Migrate From ThreatLocker In Five Stages
ThreatLocker stays secured on every device until Warden has run there long enough to prove itself. Nothing moves to an open state at any point.
-
01
Inventory
Export what ThreatLocker enforces
Export the application policy, Ringfencing rules, Elevation and Storage policies, and the list of modules licensed per device. Note your renewal date.
-
02
Pilot group
Run both on one group
Add the Warden agent to the ThreatLocker allowlist for a representative group, set mutual exclusions, and leave ThreatLocker secured.
-
03
Map controls
Decide what each module becomes
Use the control map below. Confirm how you will handle admin elevation and any Storage Control rules before wider rollout.
-
04
Expand
Roll out in waves
Extend Warden by department or site. Retire ThreatLocker policies for each wave only after its sign-off.
-
05
Retire
Remove the ThreatLocker agent
After final sign-off, uninstall the ThreatLocker agent from the portal or with your deployment tool, confirm removal on every host, and time it to your renewal.
What Happens To Each ThreatLocker Module
Not every module has a Warden equivalent. Two of them are worth keeping a plan for.
Unknown executables run inside containment instead of being blocked. Known, trusted software runs normally. There is no allowlist to carry over.
Containment limits what unknown applications can reach without per-application rules. If you rely on Ringfencing to constrain known applications, list those rules in stage 3 and decide case by case.
Warden does not manage local admin rights. Use your operating system, endpoint management tool, or keep a privilege-management product for this.
Warden device control can block or restrict USB storage, and files opened from removable media are treated as unknown. Granular network-share policy should be reviewed in stage 3.
Detection, response and 24/7 managed service are part of Warden Managed EDR.
Warden has no learning period. Devices are protected from install.
Migrate From ThreatLocker: Questions Teams Ask
Do we lose protection during the migration?
+
No. ThreatLocker stays secured on every device until that device's Warden wave signs off. Nothing is moved to learning or monitor mode to make room for Warden.
Will the two agents conflict?
+
Add the Warden agent to the ThreatLocker allowlist on pilot devices and set mutual exclusions so neither acts on the other. Test line-of-business software on the pilot group first.
What happens to our Ringfencing rules?
+
Containment covers what unknown applications can reach without rules. Rules that restrict known, approved applications have no direct equivalent, so review them in stage 3 and keep the ones you still need through another control.
How do we handle admin rights after ThreatLocker?
+
Warden does not manage elevation. Most teams move this to their operating system or endpoint management policy. Plan it before the first wave.
How long does a migration take?
+
A pilot group can run in days. A full migration usually runs in waves over several weeks and is timed to your ThreatLocker renewal.
What incident response does Warden include?
+
Incident response is included for customers running zero-dwell containment, alongside managed containment and remediation. Organizations not running zero-dwell may qualify for an IR retainer with no deposit. Contact us to see if you qualify.
Can we keep ThreatLocker on some systems?
+
Yes. Many teams keep it on fixed-function systems such as kiosks, servers and OT, where default-deny fits well, and move user workstations to Warden.
Migrate From ThreatLocker, Starting With One Group
Choose the team that raises the most approval requests. Run Warden there with ThreatLocker still secured, and compare the next month of requests, tickets and stops.