WDACConfig

WDACConfig (Windows Defender Application Control) Module

WDACConfig is an advanced PowerShell module designed with the aim of automating Application and File whitelisting in Windows using Windows Defender Application Control (App Control for Business Policies). You can always find its source code on GitHub and Install it from PowerShell Gallery.

This page is also available on my website.

Requirements

• PowerShell Core latest version

  • Install from GitHub or Microsoft Store

• Windows 11 latest version

• Administrator Privileges

• Internet Connection (for periodic update checks)

Features

• Uses the official documented methods of the ConfigCI module.

• Checks for new version periodically and updates itself automatically when necessary.

  • Update check can be skipped with -SkipVersionCheck.

• Actively trying to design it with Microsoft Security Development Lifecycle (SDL) guidelines in mind.

• The module goes through Extended Validation before each update is released to make sure everything works perfectly.

• The module can be used for managing both local systems and systems in Azure VMs.

• Use -Verbose common parameter with each cmdlet of the WDACConfig module to see extra details and what's happening under the hood.

Install The Module

Install-Module -Name 'WDACConfig' -Scope 'AllUsers' -Force

WDACConfig Module's Table of Content

Cmdlet Guide	Usage	PowerShell Console Help
New-WDACConfig	Mainly for creating and deploying WDAC policies	Get-Help New-WDACConfig
New-SupplementalWDACConfig	To create and deploy Supplemental policies	Get-Help New-SupplementalWDACConfig
Remove-WDACConfig	To remove deployed WDAC policies	Get-Help Remove-WDACConfig
Edit-WDACConfig	To edit deployed unsigned WDAC policies	Get-Help Edit-WDACConfig
Edit-SignedWDACConfig	To edit deployed signed WDAC policies	Get-Help Edit-SignedWDACConfig
Deploy-SignedWDACConfig	To sign and deploy WDAC policies	Get-Help Deploy-SignedWDACConfig
Confirm-WDACConfig	To confirm deployment and check the status of WDAC policies	Get-Help Confirm-WDACConfig
New-DenyWDACConfig	To create a deny mode WDAC policy	Get-Help New-DenyWDACConfig
Set-CommonWDACConfig	To add or edit user configurations for common WDACConfig parameters	Get-Help Set-CommonWDACConfig
New-KernelModeWDACConfig	To create a Strict Kernel mode WDAC policy for total BYOVD protection	Get-Help New-KernelModeWDACConfig
Get-CommonWDACConfig	To display or fetch user configurations for common WDACConfig parameters	Get-Help Get-CommonWDACConfig
Invoke-WDACSimulation	To simulate a WDAC policy deployment quickly	Get-Help Invoke-WDACSimulation
Remove-CommonWDACConfig	To remove user configurations for common WDACConfig parameters	Get-Help Remove-CommonWDACConfig
Assert-WDACConfigIntegrity	To ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud	Get-Help Assert-WDACConfigIntegrity
Build-WDACCertificate	To create proper code signing certificates for WDAC policy signing	Get-Help Build-WDACCertificate
Test-CiPolicy	Tests a Code Integrity (WDAC) Policy XML file against the Schema and shows the signers in a signed .CIP files	Get-Help Test-CiPolicy
Get-CiFileHashes	Calculates the Authenticode hash and first page hash of the PEs with SHA1 and SHA256 algorithms	Get-Help Get-CiFileHashes
ConvertTo-WDACPolicy	Multi-Purpose & Powerful functionalities such as converting local and MDE logs to App Control Policies	Get-Help ConvertTo-WDACPolicy

User Configurations Directory

The module stores user configurations and all of the outputs only in the following directory:

C:\Program Files\WDACConfig

It's an Admin-protected path that provides security against non-elevated users and processes.

The Temporary Files Are Stored in the Following Directory

C:\Program Files\WDACConfig\StagingArea

Each cmdlet of the module creates a subdirectory in the StagingArea to store its temporary files. The subdirectory is named after the cmdlet's name. At the end of the cmdlet's execution, the temporary subdirectory is deleted, unless the -Debug parameter is used.

About Automatic Parameters

A parameter with an Automatic value of True in the description means that the module will use its default value set by the Set-CommonWDACConfig cmdlet. This simplifies the process and avoids redundancy. However, if an Automatic parameter has no value in User Configurations and you do not specify one in the command line, you will encounter an error requesting a value. Specifying a value for an Automatic parameter in the command line supersedes its default value in User Configurations, so the module will disregard the value of that parameter in the User Configurations file.

The Logic Behind The -SignToolPath Parameter in the Module

1. If Windows SDK Signing Tools for Desktop Apps components is installed in the default location C:\Program Files (x86)\Windows Kits, then specifying -SignToolPath parameter isn't necessary as the SignTool.exe will be detected automatically.

2. If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you either specify its path using Set-CommonWDACConfig -SignToolPath or use the -SignToolPath parameter.

3. If SignTool.exe path is available in user configurations then it will be automatically used.

4. Specifying -SignToolPath parameter explicitly on the command line takes priority over auto detection and value in the user configurations.

5. If SignTool.exe cannot be auto-detected and the user didn't specify it on the command line, you will receive a prompt to authorize the automatic download of the most recent SignTool.exe version from the official Microsoft servers. Upon confirmation, it will be saved in your user configurations and utilized by the cmdlet.

Video Guides

Feedback and Feature Request

If there are any feedback or feature requests regarding this module, please open a new discussion/issue on GitHub.