WDACConfig Module
Important
This module is being deprecated. Use the new AppControl Manager application -> https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager
YouTube demo: https://www.youtube.com/watch?v=SzMs13n7elE
WDACConfig is an advanced PowerShell module designed with the aim of automating Application and File whitelisting in Windows using App Control for Business. You can always find its source code on GitHub and Install it from PowerShell Gallery.
This page is also available on my website.
Requirements¶
-
PowerShell Core latest version
- Install from GitHub or Microsoft Store
-
Windows 11 latest version
- Administrator Privileges
- Internet Connection (for periodic update checks that happen every 30 minutes)
Features¶
-
Uses the official documented methods of the ConfigCI module.
-
Checks for new version periodically and updates itself automatically when necessary.
- Controllable using
Set-CommonWDACConfig -AutoUpdate $True/$False
.
- Controllable using
-
Actively trying to design it with Microsoft Security Development Lifecycle (SDL) guidelines in mind.
-
The module goes through Extended Validation before each update is released to make sure everything works perfectly.
-
The module can be used for managing local systems, remote systems and Azure VMs.
-
Use
-Verbose
common parameter with each cmdlet of the WDACConfig module to see extra details and what's happening under the hood.
Install The Module¶
Video Guides¶
WDACConfig Module's Table of Content¶
Cmdlet Guide | Usage | PowerShell Console Help |
---|---|---|
New-WDACConfig | Mainly for creating and deploying App Control policies | Get-Help New-WDACConfig |
New-SupplementalWDACConfig | To create and deploy Supplemental policies | Get-Help New-SupplementalWDACConfig |
Remove-WDACConfig | To remove deployed App Control policies | Get-Help Remove-WDACConfig |
Edit-WDACConfig | To edit deployed unsigned App Control policies | Get-Help Edit-WDACConfig |
Edit-SignedWDACConfig | To edit deployed signed App Control policies | Get-Help Edit-SignedWDACConfig |
Deploy-SignedWDACConfig | To sign and deploy App Control policies | Get-Help Deploy-SignedWDACConfig |
Confirm-WDACConfig | To confirm deployment and check the status of App Control policies | Get-Help Confirm-WDACConfig |
New-DenyWDACConfig | To create a deny mode App Control policy | Get-Help New-DenyWDACConfig |
Set-CommonWDACConfig | To add or edit user configurations for common WDACConfig parameters | Get-Help Set-CommonWDACConfig |
New-KernelModeWDACConfig | To create a Strict Kernel mode App Control policy for total BYOVD protection | Get-Help New-KernelModeWDACConfig |
Get-CommonWDACConfig | To display or fetch user configurations for common WDACConfig parameters | Get-Help Get-CommonWDACConfig |
Invoke-WDACSimulation | To simulate an App Control policy deployment quickly | Get-Help Invoke-WDACSimulation |
Remove-CommonWDACConfig | To remove user configurations for common WDACConfig parameters | Get-Help Remove-CommonWDACConfig |
Assert-WDACConfigIntegrity | To ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud | Get-Help Assert-WDACConfigIntegrity |
Build-WDACCertificate | To create proper code signing certificates for App Control policy signing | Get-Help Build-WDACCertificate |
Test-CiPolicy | Tests a Code Integrity (App Control) Policy XML file against the Schema and shows the signers in a signed .CIP files |
Get-Help Test-CiPolicy |
Get-CiFileHashes | Calculates the Authenticode hash and first page hash of the PEs with SHA1 and SHA256 algorithms | Get-Help Get-CiFileHashes |
ConvertTo-WDACPolicy | Multi-Purpose & Powerful functionalities such as converting local and MDE logs to App Control Policies | Get-Help ConvertTo-WDACPolicy |
Get-CIPolicySetting | Queries the Secure Settings among the deployed policies on the system | Get-Help Get-CIPolicySetting |
User Configurations Directory¶
The module stores user configurations and all of the outputs only in the following directory:
It's an Admin-protected path that provides security against non-elevated users and processes.
The Temporary Files Are Stored in the Following Directory¶
Each cmdlet of the module creates a subdirectory in the StagingArea to store its temporary files. The subdirectory is named after the cmdlet's name. At the end of the cmdlet's execution, the temporary subdirectory is deleted, unless the -Debug
parameter is used.
About Automatic Parameters¶
A parameter with an Automatic value of True in the description means that the module will use its default value set by the Set-CommonWDACConfig cmdlet. This simplifies the process and avoids redundancy. However, if an Automatic parameter has no value in User Configurations and you do not specify one in the command line, you will encounter an error requesting a value. Specifying a value for an Automatic parameter in the command line supersedes its default value in User Configurations, so the module will disregard the value of that parameter in the User Configurations file.
The Logic Behind The -SignToolPath Parameter in the Module¶
-
If Windows SDK Signing Tools for Desktop Apps components is installed in the default location
C:\Program Files (x86)\Windows Kits
, then specifying-SignToolPath
parameter isn't necessary as the SignTool.exe will be detected automatically. -
If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you either specify its path using
Set-CommonWDACConfig -SignToolPath
or use the-SignToolPath
parameter. -
If SignTool.exe path is available in user configurations then it will be automatically used.
-
Specifying
-SignToolPath
parameter explicitly on the command line takes priority over auto detection and value in the user configurations. -
If SignTool.exe cannot be auto-detected and the user didn't specify it on the command line, you will receive a prompt to authorize the automatic download of the most recent SignTool.exe version from the official Microsoft servers. Upon confirmation, it will be saved in your user configurations and utilized by the cmdlet.
Feedback and Feature Request¶
If there are any feedback or feature requests regarding this module, please open a new discussion/issue on GitHub.