WDACConfig

Author(s)

• HotCakeX

Tags

WDAC Windows-Defender-Application-Control Windows Security Microsoft Application-Control MDAC Application-Whitelisting

Cmdlets

New-WDACConfig Remove-WDACConfig Deploy-SignedWDACConfig Confirm-WDACConfig Edit-WDACConfig Edit-SignedWDACConfig New-SupplementalWDACConfig New-DenyWDACConfig

Functions

New-WDACConfig Remove-WDACConfig Deploy-SignedWDACConfig Confirm-WDACConfig Edit-WDACConfig Edit-SignedWDACConfig New-SupplementalWDACConfig New-DenyWDACConfig

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

## Version 0.1.5
Added alias for many parameters for easier access.
Added new cmdlet: New-DenyWDACConfig for creating base policies with Deny rules. They can be deployed side by side other policies without conflict.
Added argument completer for many new parameters and improved the previous ones to be smarter in their suggestions.

## Version 0.1.4
Code optimization.
Implemented a check to make sure Windows 11 22H2 is being used as it's a requirement for this module to run.
Improved Remove-WDACConfig cmdlet by making the argument completers only show policies that haven't been already deleted, also applied a fix to this cmdlet for when multiple policies with the same name are deployed.   

## Version 0.1.3
Improved Remove-WDACConfig cmdlet so handle situations where multiple policies with the exact same name are deployed and user is trying to remove them.
Changed some of the parameter names in Remove-WDACConfig cmdlet to better reflect their jobs and how they are supposed to be used.
New cmdlet: New-SupplementalWDACConfig: dedicated to making all kinds of supplemental policies only - Removed the Supplemental parameter from New-WDACConfig cmdlet and instead the new cmdlet handles anything related to Supplemental policy creation/deployment.          
New-SupplementalWDACConfig cmdlet supports AppxPackages, FilePaths with one or more wildcard characters and of course the normal supplemental policy creation with granular levels and fallbacks and more.
Removed the Debugmode parameter from certain cmdlets and instead now detecting the usage of the default PowerShell -Debug switch and do debugging actions based on that.
The Edit-WDACConfig and Edit-SignedWDACConfig cmdlets now detect and create allow rules for kernel protected files.
New parameter for New-WDACConfig: -DeployLatestBlockRules, will deploy the latest Microsoft recommended block rules on the system, as a standalone base policy.
Implemented a feature to prevent users from accidentally attempting to remove Signed policies that aren't even deployed on the system.
Plus a LOT of code optimizations.

## Version 0.1.2
Made the Get-SignTool function more secure.
Added smarter argument completer to Remove-WDACConfig cmdlet.


Full Change log for previous versions are available on Excel online: (Copy and paste the link in your browser if it isn't clickable)
https://1drv.ms/x/s!AtCaUNAJbbvIhuVPpPeCHSjl75OqBQ?e=qgvzEt