New-KernelModeWDACConfig available parameters

Syntax

New-KernelModeWDACConfig
    -Mode <String>
    [-Deploy]
    [-EVSigners]
    [-Base <String>]
    [-SkipVersionCheck]
    [<CommonParameters>]

Description

This cmdlet generates a Kernel-mode WDAC policy derived from the Default Windows template policy. You can learn more about that procedure in here.

Initially, you need to use the -Mode Prep parameter to deploy the base policy in Audit mode, then restart your system. After restarting, event logs are produced for Kernel-mode drivers that are running but would otherwise be blocked if the policy was not deployed in Audit mode.

Subsequently, you need to use the -Mode AuditAndEnforce parameter to generate the final base policy. This parameter will:

1. Scan all of the event logs that were produced after deploying the audit mode policy on the system
2. Generate a supplemental policy for the drivers detected in event logs
3. Merge the supplemental policy with the Strict Kernel-mode base policy
4. Deploy it as a single base policy, rebootlessly.

Tip

All Kernel-mode drivers are scanned with WHQLFilePublisher level, so they will not necessitate a policy update when they are updated.

Parameters

-Mode

Specifies the mode of operation. The acceptable values for this parameter are: Prep and AuditAndEnforce.

• Prep: Deploys the Strict Kernel-mode WDAC policy in Audit mode, preparing the system for an Audit.

• AuditAndEnforce: Audits the system using event logs for any blocked drivers, generates the final Strict Kernel-mode WDAC policy.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Deploy

Indicates that the policy will be deployed. If you want to deploy the final strict kernel-mode base policy Signed, do not use this parameter, Instead just create the policy and then use the Deploy-SignedWDACConfig cmdlet to deploy it.

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EVSigners

Uses EVSigners policy rule option. If you want to use this parameter, make sure you use it for both Prep and AuditAndEnforce modes. Read more about EV Signers

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Base

The base policy to be used. The acceptable values for this parameter are: Default and NoFlightRoots.

Note

The NoFlightRoots value signifies that the Strict Kernel-mode WDAC policy will not be deployed with flight root certificates, disallowing you to use insider builds of the OS in the Dev and Canary channels. Insider builds in the Beta and Release Preview channels are signed with production root certificates and will not be affected.

Type:	String
Position:	Named
Default value:	Default
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False