Edit WDACConfig

Edit-WDACConfig available parameters

Edit-WDACConfig -MergeSupplementalPolicies

Syntax

Edit-WDACConfig
     [-MergeSupplementalPolicies]
     -SuppPolicyName <String>
     [-PolicyPath <FileInfo>]
     -SuppPolicyPaths <FileInfo[]>
     [-KeepOldSupplementalPolicies]s
     [<CommonParameters>]

Description

Merge multiple deployed Supplemental policies into 1 and deploy it, remove the individual ones, all happening automatically.

Parameters

-SuppPolicyName

Choose a descriptive name for the Supplemental policy that is going to be the merge of multiple policies.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-SuppPolicyPaths

Path to the Supplemental policies xml files. Supports argument tab completion by showing only Supplemental policy types.

Type:	FileInfo[]
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-PolicyPath

Path to the Base policy xml file the Supplemental policies belong to. Supports argument tab completion by showing only Base policy types.

Type:	FileInfo
Position:	Named
Default value:	None
Required:	False
Automatic:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-KeepOldSupplementalPolicies

Indicates that the module will not remove the old Supplemental policy xml files after creating and deploying the new merged one.

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Edit-WDACConfig -UpdateBasePolicy

Syntax

Edit-WDACConfig
     [-UpdateBasePolicy]
     -CurrentBasePolicyName <String[]>
     -NewBasePolicyType <String>
     [-RequireEVSigners]
     [<CommonParameters>]

Description

It can rebootlessly change the type or rule options of the deployed base policy. The deployed Supplemental policies will stay intact and continue to work with the new Base policy.

Note

When switching from a more permissive base policy type to a more restrictive one, make sure your Supplemental policies will continue to work. E.g., if your current base policy type is AllowMicrosoft and the one you are switching to is DefaultWindows, there might be files that will get blocked as a result of this switch.

That's simply because they were allowed by the more permissive AllowMicrosoft policy type so they didn't trigger audit logs (in case the supplemental policy was created based on audit logs) thus weren't needed to be included in the Supplemental policy. You will need to update those Supplemental policies if that happens by deleting and recreating them, no immediate reboot required.

Parameters

-CurrentBasePolicyName

The name of the currently deployed base policy. It supports tab completion so just press tab to autofill it.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-NewBasePolicyType

The new type of the base policy to deploy. It supports tab completion so just press tab to autofill it. Supports all 3 main Base policy types.

Note

If the selected policy type is DefaultWindows and the detected PowerShell is not installed through Microsoft Store, the module will scan the PowerShell files and add them to the DefaultWindows base policy as allowed files so you will be able to continue using the module after deploying the policy.

Type:	String
Position:	Named
Accepted values:	AllowMicrosoft, DefaultWindows, SignedAndReputable
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-RequireEVSigners

Indicates that the created/deployed policy will have Require EV Signers policy rule option.

• In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement.

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False