WDACConfig

WDACConfig (Windows Defender Application Control) Module

WDACConfig is an advanced PowerShell module designed with the aim of automating Application and File whitelisting in Windows using Windows Defender Application Control (App Control for Business Policies). You can always find its source code on GitHub and Install it from PowerShell Gallery.

This page is also available on my website.

Requirements

• PowerShell Core latest version

  • Install from GitHub or Microsoft Store

• Windows 11 latest version

• Administrator Privileges

• Internet Connection (for periodic update checks)

Features

• Uses the official documented methods of the ConfigCI module.

• Checks for new version periodically and updates itself automatically when necessary.

  • Update check can be skipped with -SkipVersionCheck.

• Actively trying to design it with Microsoft Security Development Lifecycle (SDL) guidelines in mind.

• The module goes through Extended Validation before each update is released to make sure everything works perfectly.

• The module can be used for managing both local systems and systems in Azure VMs.

• Use -Verbose common parameter with each cmdlet of the WDACConfig module to see extra details and what's happening under the hood.

Install The Module

Install-Module -Name 'WDACConfig' -Force

WDACConfig Module's Table of Content

Cmdlet Guide	Usage	PowerShell Console Help
New-WDACConfig	Mainly for creating and deploying WDAC policies	Get-Help New-WDACConfig
New-SupplementalWDACConfig	To create and deploy Supplemental policies	Get-Help New-SupplementalWDACConfig
Remove-WDACConfig	To remove deployed WDAC policies	Get-Help Remove-WDACConfig
Edit-WDACConfig	To edit deployed unsigned WDAC policies	Get-Help Edit-WDACConfig
Edit-SignedWDACConfig	To edit deployed signed WDAC policies	Get-Help Edit-SignedWDACConfig
Deploy-SignedWDACConfig	To sign and deploy WDAC policies	Get-Help Deploy-SignedWDACConfig
Confirm-WDACConfig	To confirm deployment and check the status of WDAC policies	Get-Help Confirm-WDACConfig
New-DenyWDACConfig	To create a deny mode WDAC policy	Get-Help New-DenyWDACConfig
Set-CommonWDACConfig	To add or edit user configurations for common WDACConfig parameters	Get-Help Set-CommonWDACConfig
New-KernelModeWDACConfig	To create a Strict Kernel mode WDAC policy for total BYOVD protection	Get-Help New-KernelModeWDACConfig
Get-CommonWDACConfig	To display or fetch user configurations for common WDACConfig parameters	Get-Help Get-CommonWDACConfig
Invoke-WDACSimulation	To simulate a WDAC policy deployment quickly	Get-Help Invoke-WDACSimulation
Remove-CommonWDACConfig	To remove user configurations for common WDACConfig parameters	Get-Help Remove-CommonWDACConfig
Assert-WDACConfigIntegrity	To ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud	Get-Help Assert-WDACConfigIntegrity
Build-WDACCertificate	To create proper code signing certificates for WDAC policy signing	Get-Help Build-WDACCertificate

About Automatic Parameters

If a parameter's Automatic value is set to True in the parameter description, it indicate that if you used Set-CommonWDACConfig cmdlet to set default value for it, the module will automatically use it. This saves time and prevents repetitive tasks. However, if no value exists in User Configurations for an Automatic parameter and you didn't explicitly provide a value for that parameter either, then you will see an error asking you to provide value for it. Explicitly providing a value for an Automatic parameter in the command line overrides its default value in the User Configurations, meaning the module will ignore the value of the same parameter in the User Configurations file.

The Logic Behind The -SignToolPath Parameter in the Module

1. If Windows SDK Signing Tools for Desktop Apps components is installed in the default location C:\Program Files (x86)\Windows Kits, then specifying -SignToolPath parameter isn't necessary as the SignTool.exe will be detected automatically.

2. If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you either specify its path using Set-CommonWDACConfig -SignToolPath or use the -SignToolPath parameter.

3. If SignTool.exe path is available in user configurations then it will be automatically used.

4. Specifying -SignToolPath parameter explicitly on the command line takes priority over auto detection and value in the user configurations.

5. If SignTool.exe cannot be auto-detected and the user didn't specify it on the command line, you will receive a prompt to authorize the automatic download of the most recent SignTool.exe version from the official Microsoft servers. Upon confirmation, it will be saved in your user configurations and utilized by the cmdlet. The file itself will be saved in the current working directory.

Video Guides

Feedback and Feature Request

If there are any feedback or feature requests regarding this module, please open a new discussion/issue on GitHub.