diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md index d100941402..3aed014401 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md @@ -28,13 +28,12 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p > [!NOTE] > To use this procedure, download and distribute the [WDAC policy refresh tool](https://aka.ms/refreshpolicy) to all managed endpoints. Ensure your WDAC policies allow the WDAC policy refresh tool or use a managed installer to distribute the tool. -## Script-based deployment process for WDAC policy +## Script-based deployment process for Windows 10 version 1903 and above 1. Initialize the variables to be used by the script. ```powershell # Policy binary files should be named as {GUID}.cip for multiple policy format files (where {GUID} = from the Policy XML) - # Single policy format binaries should be named as SiPolicy.p7b. $PolicyBinary = "" $DestinationFolder = $env:windir+"\System32\CodeIntegrity\CIPolicies\Active\" $RefreshPolicyTool = "" @@ -43,7 +42,7 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p 2. Copy WDAC policy binary to the destination folder. ```powershell - cp $PolicyBinary $DestinationFolder + Copy-Item -Path $PolicyBinary -Destination $DestinationFolder -Force ``` 3. Repeat steps 1-2 as appropriate to deploy additional WDAC policies. @@ -53,4 +52,24 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p & $RefreshPolicyTool ``` -5. If successful, you should see the message **Rebootless ConfigCI Policy Refreshing Succeeded!** +## Script-based deployment process for Windows 10 versions earlier than 1903 + +1. Initialize the variables to be used by the script. + + ```powershell + # Policy binary files should be named as SiPolicy.p7b for Windows 10 versions earlier than 1903 + $PolicyBinary = "" + $DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b" + ``` + +2. Copy WDAC policy binary to the destination. + + ```powershell + Copy-Item -Path $PolicyBinary -Destination $DestinationBinary -Force + ``` + +3. Refresh and activate WDAC policy using WMI + + ```powershell + Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary} + ```