windows-itpro-docs/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md

title, description, keywords, ms.prod, audience, ms.collection, author, ms.reviewer, ms.author, ms.manager, manager, ms.date, ms.technology, ms.topic, ms.localizationpriority

title	description	keywords	ms.prod	audience	ms.collection	author	ms.reviewer	ms.author	ms.manager	manager	ms.date	ms.technology	ms.topic	ms.localizationpriority
Deploy Windows Defender Application Control (WDAC) policies using script (Windows 10)	Use scripts to deploy Windows Defender Application Control (WDAC) policies. Learn how with this step-by-step guide.	security, malware	m365-security	ITPro	M365-security-compliance	jsuther1974	jogeurte	jogeurte	jsuther	dansimp	04/14/2021	mde	article	medium

Deploy WDAC policies using script

Applies to:

• Windows 10
• Windows Server 2016 and above

This topic describes how to deploy Windows Defender Application Control (WDAC) policies using script. The instructions below use PowerShell but can work with any scripting host.

Note

To use this procedure, download and distribute the WDAC policy refresh tool to all managed endpoints. Ensure your WDAC policies allow the WDAC policy refresh tool or use a managed installer to distribute the tool.

Script-based deployment process for Windows 10 version 1903 and above

1. Initialize the variables to be used by the script.

   # Policy binary files should be named as {GUID}.cip for multiple policy format files (where {GUID} = <PolicyId> from the Policy XML)
   $PolicyBinary = "<Path to policy binary file to deploy>"
   $DestinationFolder = $env:windir+"\System32\CodeIntegrity\CIPolicies\Active\"
   $RefreshPolicyTool = "<Path where RefreshPolicy.exe can be found from managed endpoints>"
   

2. Copy WDAC policy binary to the destination folder.

   Copy-Item -Path $PolicyBinary -Destination $DestinationFolder -Force
   

3. Repeat steps 1-2 as appropriate to deploy additional WDAC policies.

4. Run RefreshPolicy.exe to activate and refresh all WDAC policies on the managed endpoint.

   & $RefreshPolicyTool
   

Script-based deployment process for Windows 10 versions earlier than 1903

1. Initialize the variables to be used by the script.

   # Policy binary files should be named as SiPolicy.p7b for Windows 10 versions earlier than 1903
   $PolicyBinary = "<Path to policy binary file to deploy>"
   $DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b"
   

2. Copy WDAC policy binary to the destination.

   Copy-Item  -Path $PolicyBinary -Destination $DestinationBinary -Force
   

3. Refresh and activate WDAC policy using WMI

   Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary}