deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 02:43:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

editorial revision

Browse Source
This commit is contained in:
Aaron Czechowski
2023-10-02 12:09:28 -07:00
parent c36ccde189
commit f546eb6301
1 changed files with 43 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
windows/security/application-security/application-control/windows-defender-application-control/operations/citool-commands.md
View File

@ -1,47 +1,48 @@
--- ---
title: Managing CI Policies and Tokens with CiTool title: Managing CI policies and tokens with CiTool
description: Learn how to use Policy Commands, Token Commands, and Miscellaneous Commands in CiTool description: Learn how to use policy commands, token commands, and miscellaneous commands in CiTool
ms.topic: how-to ms.topic: reference
ms.date: 04/05/2023 ms.date: 10/02/2023
appliesto: appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a> - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
--- ---
# CiTool technical reference # CiTool technical reference
CiTool makes Windows Defender Application Control (WDAC) policy management easier for IT admins. CI Tool can be used to manage Windows Defender Application Control policies and CI Tokens. This article describes how to use CiTool to update and manage policies. CiTool is currently included as part of the Windows image in Windows 11 version 22H2. CiTool makes Windows Defender Application Control (WDAC) policy management easier for IT admins. You can use this tool to manage Windows Defender Application Control policies and CI tokens. This article describes how to use CiTool to update and manage policies. It's currently included as part of the Windows image in Windows 11, version 22H2.
## Policy Commands ## Policy commands
| Command | Description | Alias | | Command | Description | Alias |
|--------|---------|---------| |--------|---------|---------|
| --update-policy `</Path/To/Policy/File>` | Add or update a policy on the current system | -up | | `--update-policy </Path/To/Policy/File>` | Add or update a policy on the current system. | `-up` |
| --remove-policy `<PolicyGUID>` | Remove a policy indicated by PolicyGUID from the system | -rp | | `--remove-policy <PolicyGUID>` | Remove a policy indicated by PolicyGUID from the system. | `-rp` |
| --list-policies | Dump information about all policies on the system, whether they're active or not | -lp | | `--list-policies` | Dump information about all policies on the system, whether they're active or not. | `-lp` |
## Token Commands ## Token commands
| Command | Description | Alias | | Command | Description | Alias |
|--------|---------|---------| |--------|---------|---------|
| --add-token `<Path/To/Token/File>` <--token-id ID> | Deploy a token onto the current system, with an optional specific ID. | -at | | `--add-token <Path/To/Token/File> <--token-id ID>` | Deploy a token onto the current system, with an optional specific ID. | `-at` |
| --remove-token `<ID>` | Remove a Token indicated by ID from the system. | -rt | | `--remove-token <ID>` | Remove a token indicated by ID from the system. | `-rt` |
| --list-tokens | Dump information about all tokens on the system | -lt | | `--list-tokens` | Dump information about all tokens on the system. | `-lt` |
> [!NOTE] > [!NOTE]
> Regarding `--add-token`, if `<ID>` is specified, a pre-existing token with `<ID>` should not exist. > Regarding `--add-token`, if `<ID>` is specified, a pre-existing token with `<ID>` shouldn't exist.
## Miscellaneous Commands ## Miscellaneous commands
| Command | Description | Alias | | Command | Description | Alias |
|--------|---------|---------| |--------|---------|---------|
| --device-id | Dump the Code Integrity Device ID | -id | | `--device-id` | Dump the code integrity device ID. | `-id` |
| --refresh | Attempt to Refresh WDAC Policies | -r | | `--refresh` | Attempt to refresh WDAC policies. | `-r` |
| --help | Display the tool's help menu | -h | | `--help` | Display the tool's help menu. | `-h` |
## Output Parameters and Descriptions ## Output attributes and descriptions
1. List Policies ### List policies (`--list-policies`)
```output
Policy ID: d2bda982-ccf6-4344-ac5b-0b44427b6816 Policy ID: d2bda982-ccf6-4344-ac5b-0b44427b6816
Base Policy ID: d2bda982-ccf6-4344-ac5b-0b44427b6816 Base Policy ID: d2bda982-ccf6-4344-ac5b-0b44427b6816
Friendly Name: Microsoft Windows Driver Policy Friendly Name: Microsoft Windows Driver Policy
@ -52,18 +53,19 @@ CiTool makes Windows Defender Application Control (WDAC) policy management easie
Is Currently Enforced: true Is Currently Enforced: true
Is Authorized: true Is Authorized: true
Status: 0 Status: 0
```
| Command | Description | | Attribute | Description | Example value |
|--------|---------| |--------|---------|---------|
| Policy ID | The ID of the Policy listed in <PolicyID> | Policy ID | Lists the ID of the policy. | `d2bda982-ccf6-4344-ac5b-0b44427b6816` |
| Base Policy ID | The ID of the Base Policy listed in <BasePolicyID> | Base Policy ID | Lists the ID of the base policy. | `d2bda982-ccf6-4344-ac5b-0b44427b6816` |
| Friendly Name | Value listed in <Setting Provider="PolicyInfo" Key="Information" ValueName="Name"> | Friendly Name | Value listed in `<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">` | `Microsoft Windows Driver Policy` |
| Version | Version of the policy listed in <VersionEx> | Version | Version of the policy listed in `<VersionEx>` | `2814751463178240` |
| Platform Policy | Whether the policy is a policy provided by Microsoft (e.g. Vulnerable Driver blocklist policy) | Platform Policy | Whether the policy is provided by Microsoft, for example in the vulnerable driver blocklist policy. | `true` |
| Policy is Signed | Whether the policy has a valid signature | Policy is Signed | Whether the policy has a valid signature. | `true` |
| Has File on Disk | Whether the policy file is currently on the disk | Has File on Disk | Whether the policy file is currently on the disk. | `false` |
| Is Currently Enforced | Whether the policy file is active | Is Currently Enforced | Whether the policy file is active. | `true` |
| Is Authorized | If the policy requires a token to be activated, it will return the state of authorization for the token. If the policy does not require a token, matches the state of Is Currently Enforced" | Is Authorized | If the policy requires a token to be activated, this value is the state of authorization for the token. If the policy doesn't require a token, this value matches the value for the **Is Currently Enforced** property. | `true` |
## Examples ## Examples