Skip to content

WDACConfig (Windows Defender Application Control) Module

WDACConfig is an advanced PowerShell module designed with the aim of automating Application and File whitelisting in Windows using App Control for Business. You can always find its source code on GitHub and Install it from PowerShell Gallery.

This page is also available on my website.


horizontal super thin rainbow RGB line


Requirements

  • PowerShell Core latest version

  • Windows 11 latest version

  • Administrator Privileges
  • Internet Connection (for periodic update checks that happen every 30 minutes)


horizontal super thin rainbow RGB line


Features

  • Uses the official documented methods of the ConfigCI module.

  • Checks for new version periodically and updates itself automatically when necessary.

    • Controllable using Set-CommonWDACConfig -AutoUpdate $True/$False.

  • Actively trying to design it with Microsoft Security Development Lifecycle (SDL) guidelines in mind.

  • The module goes through Extended Validation before each update is released to make sure everything works perfectly.

  • The module can be used for managing local systems, remote systems and Azure VMs.

  • Use -Verbose common parameter with each cmdlet of the WDACConfig module to see extra details and what's happening under the hood.


horizontal super thin rainbow RGB line


Install The Module

Install-Module -Name 'WDACConfig' -Scope 'AllUsers' -Force


horizontal super thin rainbow RGB line


Video Guides

Video Link Description
MDE AH Demo Microsoft Defender For Endpoint Advanced Hunting With WDACConfig Module
Sandboxing-like capabilities in the App Control Policies Sandboxing-like capabilities in the App Control Policies
Create, Deploy & Audit App Control Policies Create, Deploy & Audit App Control Policies
How To Set And Query Secure Settings in App Control Policies How To Set And Query Secure Settings in App Control Policies
How To Create And Deploy Signed App Control Policies How To Create And Deploy Signed App Control Policies
Simulating App Control Deployment in Windows Simulating App Control Deployment in Windows
Create and Deploy Signed WDAC Windows Defender Policy YouTube Guide Create Code Signing Certificate Using Windows Server


horizontal super thin rainbow RGB line


WDACConfig Module's Table of Content

Cmdlet Guide Usage PowerShell Console Help
New-WDACConfig Mainly for creating and deploying App Control policies Get-Help New-WDACConfig
New-SupplementalWDACConfig To create and deploy Supplemental policies Get-Help New-SupplementalWDACConfig
Remove-WDACConfig To remove deployed App Control policies Get-Help Remove-WDACConfig
Edit-WDACConfig To edit deployed unsigned App Control policies Get-Help Edit-WDACConfig
Edit-SignedWDACConfig To edit deployed signed App Control policies Get-Help Edit-SignedWDACConfig
Deploy-SignedWDACConfig To sign and deploy App Control policies Get-Help Deploy-SignedWDACConfig
Confirm-WDACConfig To confirm deployment and check the status of App Control policies Get-Help Confirm-WDACConfig
New-DenyWDACConfig To create a deny mode App Control policy Get-Help New-DenyWDACConfig
Set-CommonWDACConfig To add or edit user configurations for common WDACConfig parameters Get-Help Set-CommonWDACConfig
New-KernelModeWDACConfig To create a Strict Kernel mode App Control policy for total BYOVD protection Get-Help New-KernelModeWDACConfig
Get-CommonWDACConfig To display or fetch user configurations for common WDACConfig parameters Get-Help Get-CommonWDACConfig
Invoke-WDACSimulation To simulate an App Control policy deployment quickly Get-Help Invoke-WDACSimulation
Remove-CommonWDACConfig To remove user configurations for common WDACConfig parameters Get-Help Remove-CommonWDACConfig
Assert-WDACConfigIntegrity To ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud Get-Help Assert-WDACConfigIntegrity
Build-WDACCertificate To create proper code signing certificates for App Control policy signing Get-Help Build-WDACCertificate
Test-CiPolicy Tests a Code Integrity (App Control) Policy XML file against the Schema and shows the signers in a signed .CIP files Get-Help Test-CiPolicy
Get-CiFileHashes Calculates the Authenticode hash and first page hash of the PEs with SHA1 and SHA256 algorithms Get-Help Get-CiFileHashes
ConvertTo-WDACPolicy Multi-Purpose & Powerful functionalities such as converting local and MDE logs to App Control Policies Get-Help ConvertTo-WDACPolicy
Get-CIPolicySetting Queries the Secure Settings among the deployed policies on the system Get-Help Get-CIPolicySetting


horizontal super thin rainbow RGB line


User Configurations Directory

The module stores user configurations and all of the outputs only in the following directory:

C:\Program Files\WDACConfig

It's an Admin-protected path that provides security against non-elevated users and processes.


The Temporary Files Are Stored in the Following Directory

C:\Program Files\WDACConfig\StagingArea

Each cmdlet of the module creates a subdirectory in the StagingArea to store its temporary files. The subdirectory is named after the cmdlet's name. At the end of the cmdlet's execution, the temporary subdirectory is deleted, unless the -Debug parameter is used.


horizontal super thin rainbow RGB line


About Automatic Parameters

A parameter with an Automatic value of True in the description means that the module will use its default value set by the Set-CommonWDACConfig cmdlet. This simplifies the process and avoids redundancy. However, if an Automatic parameter has no value in User Configurations and you do not specify one in the command line, you will encounter an error requesting a value. Specifying a value for an Automatic parameter in the command line supersedes its default value in User Configurations, so the module will disregard the value of that parameter in the User Configurations file.


The Logic Behind The -SignToolPath Parameter in the Module

  1. If Windows SDK Signing Tools for Desktop Apps components is installed in the default location C:\Program Files (x86)\Windows Kits, then specifying -SignToolPath parameter isn't necessary as the SignTool.exe will be detected automatically.

  2. If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you either specify its path using Set-CommonWDACConfig -SignToolPath or use the -SignToolPath parameter.

  3. If SignTool.exe path is available in user configurations then it will be automatically used.

  4. Specifying -SignToolPath parameter explicitly on the command line takes priority over auto detection and value in the user configurations.

  5. If SignTool.exe cannot be auto-detected and the user didn't specify it on the command line, you will receive a prompt to authorize the automatic download of the most recent SignTool.exe version from the official Microsoft servers. Upon confirmation, it will be saved in your user configurations and utilized by the cmdlet.


horizontal super thin rainbow RGB line


Feedback and Feature Request

If there are any feedback or feature requests regarding this module, please open a new discussion/issue on GitHub.