deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-05 00:57:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'main' into vp-csp-auto3

Browse Source
This commit is contained in:
Stephanie Savell 2023-03-02 11:34:37 -06:00 committed by GitHub
commit 18a50caae9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md
View File

@ -31,18 +31,18 @@ This article describes how to deploy Windows Defender Application Control (WDAC)
You should now have one or more WDAC policies converted into binary form. If not, follow the steps described in [Deploying Windows Defender Application Control (WDAC) policies](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide).
> [!IMPORTANT]
> Due to a known issue, you should always activate new **signed** WDAC Base policies with a reboot on systems with [**memory integrity**](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) enabled. Skip all steps below that use citool.exe, RefreshPolicy.exe, or WMI to initiate a policy activation. Instead, copy the policy binary to the correct system32 and EFI locations and then activate the policy with a system restart.
> Due to a known issue, you should always activate new **signed** WDAC Base policies with a reboot on systems with [**memory integrity**](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) enabled. Skip all steps below that use CiTool, RefreshPolicy.exe, or WMI to initiate a policy activation. Instead, copy the policy binary to the correct system32 and EFI locations and then activate the policy with a system restart.
>
> This issue does not affect updates to signed Base policies that are already active on the system, deployment of unsigned policies, or deployment of supplemental policies (signed or unsigned). It also does not affect deployments to systems that are not running memory integrity.
## Deploying policies for Windows 11 22H2 and above
You can use [citool.exe](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands) to apply policies on Windows 11 22H2 with the following commands. Be sure to replace **<Path to policy binary file to deploy>** in the following example with the actual path to your WDAC policy binary file.
You can use the inbox [CiTool](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands) to apply policies on Windows 11 22H2 with the following commands. Be sure to replace **<Path to policy binary file to deploy>** in the following example with the actual path to your WDAC policy binary file.
```powershell
# Policy binary files should be named as {GUID}.cip for multiple policy format files (where {GUID} = <PolicyId> from the Policy XML)
$PolicyBinary = "<Path to policy binary file to deploy>"
citool.exe --update-policy $PolicyBinary --json
CiTool --update-policy $PolicyBinary [-json]
```
## Deploying policies for Windows 11, Windows 10 version 1903 and above, and Windows Server 2022 and above

40
windows/security/threat-protection/windows-defender-application-control/operations/citool-commands.md
View File

@ -11,9 +11,9 @@ ms.prod: windows-client
ms.technology: itpro-security
---
# CITool.exe technical reference
# CiTool technical reference
CI Tool makes Windows Defender Application Control (WDAC) policy management easier for IT admins. CI Tool can be used to manage Windows Defender Application Control policies and CI Tokens. This article describes how to use CI Tool to update and manage policies. CI Tool is currently included in Windows 11, version 22H2.
CiTool makes Windows Defender Application Control (WDAC) policy management easier for IT admins. CI Tool can be used to manage Windows Defender Application Control policies and CI Tokens. This article describes how to use CiTool to update and manage policies. CiTool is currently included as part of the Windows image in Windows 11 version 22H2.
## Policy Commands
@ -44,33 +44,45 @@ CI Tool makes Windows Defender Application Control (WDAC) policy management easi
## Examples
1. Deploy a WDAC policy onto the system
1. Deploy a WDAC policy
```powershell
PS C:\Users\<USER> CITool --update-policy "\Windows\Temp\{BF61FE40-8929-4FDF-9EC2-F7A767717F0B}.cip"
Operation Successful
Press Enter to Continue
CiTool --update-policy "\Windows\Temp\{BF61FE40-8929-4FDF-9EC2-F7A767717F0B}.cip"
```
2. Refresh the WDAC policies
2. Refresh the WDAC policies on the system
```powershell
PS C:\Users\<USER> CITool --refresh
Operation Successful
CiTool --refresh
```
3. Remove a specific WDAC policy by its policy ID
```powershell
PS C:\Users\<USER> CiTool --remove-policy "{BF61FE40-8929-4FDF-9EC2-F7A767717F0B}"
Operation Successful
Press Enter to Continue
CiTool --remove-policy "{BF61FE40-8929-4FDF-9EC2-F7A767717F0B}"
```
4. Display the help menu
4. List the actively enforced WDAC policies on the system
```powershell
PS C:\Users\<USER> CITool -h
$wdacPolicies = (CiTool -lp -json | ConvertFrom-Json).Policies
# Check each policy's IsEnforced state and return only the enforced policies
foreach($wdacPolicy in $wdacPolicies ){
if($wdacPolicy.IsEnforced)
{
Write-Host $wdacPolicy.FriendlyName
Write-Host $wdacPolicy.PolicyID "`n"
}
}
```
5. Display the help menu
```powershell
CiTool -h
----------------------------- Policy Commands ---------------------------------
--update-policy /Path/To/Policy/File