Skip to content

New‐KernelModeWDACConfig

Violet edited this page Feb 11, 2024 · 20 revisions

New-KernelModeWDACConfig available parameters

New-KernelModeWDACConfig -Default

image

New-KernelModeWDACConfig
    [-Default]
    [-PrepMode]
    [-AuditAndEnforce]
    [-Deploy]
    [-EVSigners]
    [-SkipVersionCheck]
    [-Confirm]
    [<CommonParameters>]

How to use

This cmdlet generates a Kernel-mode WDAC policy derived from the Default Windows template policy. You can learn more about that procedure in here.

Note

The -Default parameter signifies that the Strict Kernel-mode WDAC policy will be deployed with flight root certificates, enabling you to utilize insider builds of the OS in the Dev and Canary channels. Insider builds in the Beta and Release Preview channels are signed with production root certificates and will work either way.

Initially, you need to use the -PrepMode parameter to deploy the base policy in Audit mode, then restart your system. After restarting, event logs are produced for Kernel-mode drivers that are running but would otherwise be blocked if the policy was not deployed in Audit mode.

Subsequently, you need to use the -AuditAndEnforce parameter to generate the final base policy. This parameter will:

  1. Scan all of the event logs that were produced after deploying the audit mode policy on the system
  2. Generate a supplemental policy for the drivers detected in event logs
  3. Merge the supplemental policy with the Strict Kernel-mode base policy
  4. Deploy it as a single base policy, rebootlessly.

Important

Hardware drivers are scanned with WHQLFilePublisher level, so they will not necessitate a policy update when they are updated.

Parameters

-PrepMode

Deploys the Strict Kernel-mode WDAC policy in Audit mode, preparing the system for an Audit.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-AuditAndEnforce

Audits the system using event logs for any blocked drivers, generates the final Strict Kernel-mode WDAC policy.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-EVSigners

Uses EVSigners policy rule option. If you want to use this parameter, make sure you use it for both PrepMode and AuditAndEnforce parameters. Read more about EV Signers

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Deploy

Indicates that the policy will be deployed. If you want to deploy the final strict kernel-mode base policy Signed, do not use this parameter with -AuditAndEnforce. Instead just create the policy and then use Deploy-SignedWDACConfig cmdlet to deploy it.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

horizontal super thin rainbow RGB line

New-KernelModeWDACConfig -NoFlightRoots

image

New-KernelModeWDACConfig
    [-NoFlightRoots]
    [-PrepMode]
    [-AuditAndEnforce]
    [-Deploy]
    [-EVSigners]
    [-SkipVersionCheck]
    [-Confirm]
    [<CommonParameters>]

How to use

This cmdlet generates a Kernel-mode WDAC policy derived from the Default Windows template policy. You can learn more about that procedure in here.

Note

The -NoFlightRoots parameter signifies that the Strict Kernel-mode WDAC policy will not be deployed with flight root certificates, disallowing you to use insider builds of the OS in the Dev and Canary channels. Insider builds in the Beta and Release Preview channels are signed with production root certificates and will work either way.

Initially, you need to use the -PrepMode parameter to deploy the base policy in Audit mode, then restart your system. After restarting, event logs are produced for Kernel-mode drivers that are running but would otherwise be blocked if the policy was not deployed in Audit mode.

Subsequently, you need to use the -AuditAndEnforce parameter to generate the final base policy. This parameter will:

  1. Scan all of the event logs that were produced after deploying the audit mode policy on the system
  2. Generate a supplemental policy for the drivers detected in event logs
  3. Merge the supplemental policy with the Strict Kernel-mode base policy
  4. Deploy it as a single base policy, rebootlessly.

Important

Hardware drivers are scanned with WHQLFilePublisher level, so they will not necessitate a policy update when they are updated.

Parameters

-PrepMode

Deploys the Strict Kernel-mode WDAC policy in Audit mode, preparing the system for an Audit.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-AuditAndEnforce

Audits the system using event logs for any blocked drivers, generates the final Strict Kernel-mode WDAC policy.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-EVSigners

Uses EVSigners policy rule option. If you want to use this parameter, make sure you use it for both PrepMode and AuditAndEnforce parameters. Read more about EV Signers

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Deploy

Indicates that the policy will be deployed. If you want to deploy the final strict kernel-mode base policy Signed, do not use this parameter with -AuditAndEnforce. Instead just create the policy and then use Deploy-SignedWDACConfig cmdlet to deploy it.

Type: SwitchParameter
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False








C#


Clone this wiki locally