Closed HotCakeX closed 1 year ago
Deploy-SignedWDAC
cmdlet, called -Deploy
. When used, it will deploy the signed policy on the current system, otherwise it will only create the signed policy. This is specially useful for when you want to deploy the policy somewhere else using the Citool.exe built-in tool.-Deployit
parameter names to -Deploy
.-Deploy
parameter for New-WDACConfig -PrepMSFTOnlyAudit
and New-WDACConfig -PrepDefaultWindowsAudit
. This allows you to deploy those audit policies remotely to collect audit logs.Get-CommonWDACConfig
cmdlet when the user configuration json file is nonexistent.-CertPath
parameter of all the cmdlets that use it.-DeployLatestDriverBlockRules
parameter from New-WDACConfig
cmdlet and instead added the optional -Deploy
parameter to New-WDACConfig -GetDriverBlockRules
, it does the same task.-DeployLatestBlockRules
parameter from New-WDACConfig
cmdlet and instead added the optional -Deploy
parameter to New-WDACConfig -GetBlockRules
, it does the same task.confirm-WDACConfig
now runs all 3 checks if you use it without passing any parameters.Invoke-WDACSimulation
cmdlet's performance. It's faster, better and outputs CSV file for the result of the simulation.
What's changed so far
Added new parameter forDeploy-SignedWDAC
cmdlet, called-SignOnly
, indicating that the cmdlet will only output a signed WDAC policy ready for deployment and will not deploy it on the system. This is specially useful for when you want to deploy the policy somewhere else using theCitool.exe
built-in tool.Edit-SignedWDACConfig
,Remove-WDACConfig
andDeploy-SignedWDACConfig
Remove-WDACConfig
cmdlet wouldn't auto complete policy names if one of the policies didn't have a friendly name.Remove-WDACConfig
cmdlet now shows-PolicyNames
first above the-PolicyIDs
for more convenience.