How to manage WDAC
This post isn't about creating your initial policies and assumes you know how to create the first base policy, and supplemental policies. This will also setup SCCM to be a managed installer.
Just a quick post to hopefully save someone some time. Ask me anything, I may have skipped over something.
Setup
Create a base policy (base.xml), and supplemental policies, ideally 2 (SOE.xml and ThirdParty.xml) for the current setup, you can hack at the scripts to do your own thing.
Copy the XMLs to Policies\Base, Policies\SOE, Policies\ThirdParty.
Create Policy
To add a new app to wdac you use the createPolicy.ps1
1 |
.\CreatePolicy.ps1 -scanpath "C:\temp\Citrix" -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -ParentPolicy ThirdParty -policyName "Citrix" -version "1.0.0.1" |
This would create a new policy scanning the folder and making a policy for the ThirdParty policy.
Merge Policy
1 |
.\MergePolicy.ps1 -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -PolicyName ThirdParty |
This will merge all the Third Party XMLs and compile the binary.
Create App
1 |
.\CreateApp.ps1 -wdacFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -appVersion "3.0.0.2" |
This will copy the binaries to the AppBuild folder and spit out a folder ready to be deployed by SCCM.
Deploy
Create an App in sccm
Use the AppDetection.ps1 it generated, this verifies the hash of all files in the code integrity policies folder, ignoring built in ones, thiscan be altered in the createapp.ps1.
Folder Structure
AppBuild: Appbuild Contains exe's and scripts to create the SCCM app.
Appbuild\Source: Default script to deploy WDAC and make SCCM a managed installer.
Appbuild\Source\Binary: Compiled policies are moved here.
Appbuild\Builds: Script will create source files for an SCCM deployment including app detection script.
Policies\Base: Base policy xml goes here. Kind of the default policy you want before customizations
Policies\SOE: All apps that go on every machine
Policies\ThirdParty: Supplemental apps that need to be added.
There are no comments yet, add one below.