How to manage WDAC

This post isn't about creating your initial policies and assumes you know how to create the first base policy, and supplemental policies. This will also setup SCCM to be a managed installer.

Just a quick post to hopefully save someone some time. Ask me anything, I may have skipped over something.

Setup

Download Scripts

Create a base policy (base.xml), and supplemental policies, ideally 2 (SOE.xml and ThirdParty.xml) for the current setup, you can hack at the scripts to do your own thing.
Copy the XMLs to Policies\Base, Policies\SOE, Policies\ThirdParty.

Create Policy

To add a new app to wdac you use the createPolicy.ps1

This would create a new policy scanning the folder and making a policy for the ThirdParty policy.

Merge Policy

This will merge all the Third Party XMLs and compile the binary.

Create App

This will copy the binaries to the AppBuild folder and spit out a folder ready to be deployed by SCCM.

Deploy

Create an App in sccm

Use the AppDetection.ps1 it generated, this verifies the hash of all files in the code integrity policies folder, ignoring built in ones, thiscan be altered in the createapp.ps1.

Folder Structure

AppBuild: Appbuild Contains exe's and scripts to create the SCCM app.

Appbuild\Source: Default script to deploy WDAC and make SCCM a managed installer.

Appbuild\Source\Binary: Compiled policies are moved here.

Appbuild\Builds: Script will create source files for an SCCM deployment including app detection script.

Policies\Base: Base policy xml goes here. Kind of the default policy you want before customizations

Policies\SOE: All apps that go on every machine

Policies\ThirdParty: Supplemental apps that need to be added.

There are no comments yet, add one below.

Leave a Comment

Your email address will not be published. Required fields are marked *

*