New-KernelModeWDACConfig available parameters¶
Syntax¶
New-KernelModeWDACConfig
-Mode <String>
[-Deploy]
[-EVSigners]
[-Base <String>]
[<CommonParameters>]
Description¶
This cmdlet generates a Kernel-mode App Control policy derived from the Default Windows template policy. You can learn more about that procedure in here.
Initially, you need to use the -Mode Prep
parameter to deploy the base policy in Audit mode, then restart your system. After restarting, event logs are produced for Kernel-mode drivers that are running but would otherwise be blocked if the policy was not deployed in Audit mode.
Subsequently, you need to use the -Mode AuditAndEnforce
parameter to generate the final base policy. This parameter will:
- Scan all of the event logs that were produced after deploying the audit mode policy on the system
- Generate a supplemental policy for the drivers detected in event logs
- Merge the supplemental policy with the Strict Kernel-mode base policy
- Deploy it as a single base policy, rebootlessly.
Important
All Kernel-mode drivers are scanned with WHQLFilePublisher level, so they will not necessitate a policy update when they are updated.
Parameters¶
-Mode¶
Specifies the mode of operation. The acceptable values for this parameter are: Prep
and AuditAndEnforce
.
-
Prep: Deploys the Strict Kernel-mode App Control policy in Audit mode, preparing the system for an Audit.
-
AuditAndEnforce: Audits the system using event logs for any blocked drivers, generates the final Strict Kernel-mode App Control policy.
Type: | String |
---|---|
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Deploy¶
Indicates that the policy will be deployed. If you want to deploy the final strict kernel-mode base policy Signed, do not use this parameter, Instead just create the policy and then use the Deploy-SignedWDACConfig cmdlet to deploy it.
Type: | SwitchParameter |
---|---|
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-EVSigners¶
Uses EVSigners policy rule option. If you want to use this parameter, make sure you use it for both Prep
and AuditAndEnforce
modes. Read more about EV Signers
Type: | SwitchParameter |
---|---|
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Base¶
The base policy to be used. The acceptable values for this parameter are: Default
and NoFlightRoots
.
Note
The NoFlightRoots value signifies that the Strict Kernel-mode App Control policy will not be deployed with flight root certificates, disallowing you to use insider builds of the OS in the Dev and Canary channels. Insider builds in the Beta and Release Preview channels are signed with production root certificates and will not be affected.
Type: | String |
---|---|
Position: | Named |
Default value: | Default |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |