Skip to content

Commit 8f11be7

Browse files
HotCakeXHotCakeX
committed
WDACConfig update 0.2.2
1 parent 593784b commit 8f11be7

10 files changed

+139
-126
lines changed

‎WDACConfig/ArgumentCompleters.ps1

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
# argument tab auto-completion for SignToolPath param to show only .exe files in the current directory
2-
[scriptblock]$ArgumentCompleterSignToolPath = {
3-
Get-ChildItem | Where-Object { $_.extension -like '*.exe' } | ForEach-Object { return "`"$_`"" }
4-
}
5-
61
# argument tab auto-completion for CertPath param to show only .cer files in current directory and 2 sub-directories recursively
72
[scriptblock]$ArgumentCompleterCertPath = {
83
# Note the use of -Depth 1

‎WDACConfig/Deploy-SignedWDACConfig.psm1

Lines changed: 35 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ function Deploy-SignedWDACConfig {
2424

2525
[parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)]
2626
[System.String]$SignToolPath,
27+
28+
[Parameter(Mandatory = $false)][Switch]$SignOnly,
2729

2830
[Parameter(Mandatory = $false)][Switch]$SkipVersionCheck
2931
)
@@ -132,26 +134,36 @@ function Deploy-SignedWDACConfig {
132134

133135
Remove-Item ".\$PolicyID.cip" -Force
134136
Rename-Item "$PolicyID.cip.p7" -NewName "$PolicyID.cip" -Force
135-
CiTool --update-policy ".\$PolicyID.cip" -json | Out-Null
136-
Write-Host "`npolicy with the following details has been Signed and Deployed in Enforced Mode:" -ForegroundColor Green
137-
Write-Output "PolicyName = $PolicyName"
138-
Write-Output "PolicyGUID = $PolicyID`n"
139-
Remove-Item -Path ".\$PolicyID.cip" -Force
140-
141-
# Ask user question about whether or not to add the Signed policy xml file to the User Config Json for easier usage later
142-
$userInput = ''
143-
while ($userInput -notin 1, 2) {
144-
$userInput = $(Write-Host 'Add the Signed policy xml file path just created to the User Configurations? Please enter 1 to Confirm or 2 to Skip.' -ForegroundColor Cyan ; Read-Host)
145-
if ($userInput -eq 1) {
146-
Set-CommonWDACConfig -SignedPolicyPath $PolicyPath
147-
&$WriteViolet "Added $PolicyPath to the User Configuration file."
148-
}
149-
elseif ($userInput -eq 2) {
150-
&$WritePink 'Skipping...'
137+
138+
if (!$SignOnly) {
139+
140+
CiTool --update-policy ".\$PolicyID.cip" -json | Out-Null
141+
Write-Host "`npolicy with the following details has been Signed and Deployed in Enforced Mode:" -ForegroundColor Green
142+
Write-Output "PolicyName = $PolicyName"
143+
Write-Output "PolicyGUID = $PolicyID`n"
144+
Remove-Item -Path ".\$PolicyID.cip" -Force
145+
146+
# Ask user question about whether or not to add the Signed policy xml file to the User Config Json for easier usage later
147+
$userInput = ''
148+
while ($userInput -notin 1, 2) {
149+
$userInput = $(Write-Host 'Add the Signed policy xml file path just created to the User Configurations? Please enter 1 to Confirm or 2 to Skip.' -ForegroundColor Cyan ; Read-Host)
150+
if ($userInput -eq 1) {
151+
Set-CommonWDACConfig -SignedPolicyPath $PolicyPath
152+
&$WriteViolet "Added $PolicyPath to the User Configuration file."
153+
}
154+
elseif ($userInput -eq 2) {
155+
&$WritePink 'Skipping...'
156+
}
157+
else {
158+
Write-Warning 'Invalid input. Please enter 1 or 2 only.'
159+
}
151160
}
152-
else {
153-
Write-Warning 'Invalid input. Please enter 1 or 2 only.'
154-
}
161+
}
162+
163+
else {
164+
Write-Host "`npolicy with the following details has been Signed and is ready for deployment:" -ForegroundColor Green
165+
Write-Output "PolicyName = $PolicyName"
166+
Write-Output "PolicyGUID = $PolicyID`n"
155167
}
156168
}
157169
}
@@ -184,6 +196,9 @@ Certificate common name
184196
.PARAMETER SignToolPath
185197
Path to the SignTool.exe - optional parameter
186198
199+
.PARAMETER SignOnly
200+
Indicates that the cmdlet only signs the WDAC policy and will not deploy it to the system. Useful for when you want to deploy it elsewhere.
201+
187202
.PARAMETER SkipVersionCheck
188203
Can be used with any parameter to bypass the online version check - only to be used in rare cases
189204
@@ -197,4 +212,4 @@ Set-PSReadLineKeyHandler -Key Tab -Function MenuComplete
197212
Register-ArgumentCompleter -CommandName 'Deploy-SignedWDACConfig' -ParameterName 'CertCN' -ScriptBlock $ArgumentCompleterCertificateCN
198213
Register-ArgumentCompleter -CommandName 'Deploy-SignedWDACConfig' -ParameterName 'PolicyPaths' -ScriptBlock $ArgumentCompleterPolicyPaths
199214
Register-ArgumentCompleter -CommandName 'Deploy-SignedWDACConfig' -ParameterName 'CertPath' -ScriptBlock $ArgumentCompleterCertPath
200-
Register-ArgumentCompleter -CommandName 'Deploy-SignedWDACConfig' -ParameterName 'SignToolPath' -ScriptBlock $ArgumentCompleterSignToolPath
215+
Register-ArgumentCompleter -CommandName 'Deploy-SignedWDACConfig' -ParameterName 'SignToolPath' -ScriptBlock $ArgumentCompleterExeFilePathsPicker

‎WDACConfig/Edit-SignedWDACConfig.psm1

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#Requires -RunAsAdministrator
1+
#Requires -RunAsAdministrator
22
function Edit-SignedWDACConfig {
33
[CmdletBinding(
44
DefaultParameterSetName = 'Allow New Apps Audit Events',
@@ -256,7 +256,7 @@ function Edit-SignedWDACConfig {
256256
# The notice about variable being assigned and never used should be ignored - it's being dot-sourced from Resources file
257257
[datetime]$Date = Get-Date
258258
# An empty array that holds the Policy XML files - This array will eventually be used to create the final Supplemental policy
259-
[System.Array]$PolicyXMLFilesArray = @()
259+
[System.Object[]]$PolicyXMLFilesArray = @()
260260

261261
################################### Initiate Live Audit Mode ###################################
262262

@@ -333,9 +333,9 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
333333
&$WritePink "`nAudit mode deployed, start installing your programs now"
334334
&$WriteViolet "When you've finished installing programs, Press Enter to start selecting program directories to scan`n"
335335
Pause
336-
336+
337337
# Store the program paths that user browses for in an array
338-
[System.Array]$ProgramsPaths = @()
338+
[System.Object[]]$ProgramsPaths = @()
339339
Write-Host "`nSelect program directories to scan" -ForegroundColor Cyan
340340
# Showing folder picker GUI to the user for folder path selection
341341
do {
@@ -469,7 +469,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
469469
# Any other attempts such as "Get-FileHash" or "Get-AuthenticodeSignature" fail and ConfigCI Module cmdlets totally ignore these files and do not create allow rules for them
470470

471471
# Finding the file(s) first and storing them in an array
472-
[System.Array]$ExesWithNoHash = @()
472+
[System.Object[]]$ExesWithNoHash = @()
473473
# looping through each user-selected path(s)
474474
foreach ($ProgramsPath in $ProgramsPaths) {
475475
# Making sure the currently processing path has any .exe in it
@@ -621,7 +621,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
621621
Remove-Item -Path '.\ProgramDir_ScanResults*.xml' -Force -ErrorAction SilentlyContinue
622622
Remove-Item -Path ".\SupplementalPolicy$SuppPolicyName.xml" -Force -ErrorAction SilentlyContinue
623623
# An empty array that holds the Policy XML files - This array will eventually be used to create the final Supplemental policy
624-
[System.Array]$PolicyXMLFilesArray = @()
624+
[System.Object[]]$PolicyXMLFilesArray = @()
625625

626626
#Initiate Live Audit Mode
627627

@@ -700,7 +700,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
700700
Pause
701701

702702
# Store the program paths that user browses for in an array
703-
[System.Array]$ProgramsPaths = @()
703+
[System.Object[]]$ProgramsPaths = @()
704704
Write-Host "`nSelect program directories to scan`n" -ForegroundColor Cyan
705705
# Showing folder picker GUI to the user for folder path selection
706706
do {
@@ -910,8 +910,6 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
910910
New-Item -Path "$env:TEMP\TemporarySignToolFile" -ItemType Directory -Force | Out-Null
911911
Copy-Item -Path $SignToolPathFinal -Destination "$env:TEMP\TemporarySignToolFile" -Force
912912
New-CIPolicy -ScanPath "$env:TEMP\TemporarySignToolFile" -Level FilePublisher -Fallback Hash -UserPEs -UserWriteablePaths -MultiplePolicyFormat -AllowFileNameFallbacks -FilePath .\SignTool.xml
913-
# Due to a bug Have to repeat this process twice: https://github.com/MicrosoftDocs/WDAC-Toolkit/issues/278
914-
New-CIPolicy -ScanPath "$env:TEMP\TemporarySignToolFile" -Level FilePublisher -Fallback Hash -UserPEs -UserWriteablePaths -MultiplePolicyFormat -AllowFileNameFallbacks -FilePath .\SignTool.xml
915913
# Delete the Temporary folder in the TEMP folder
916914
if (!$Debug) { Remove-Item -Recurse -Path "$env:TEMP\TemporarySignToolFile" -Force }
917915

@@ -1025,6 +1023,6 @@ Can be used with any parameter to bypass the online version check - only to be u
10251023
Set-PSReadLineKeyHandler -Key Tab -Function MenuComplete
10261024
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'CertCN' -ScriptBlock $ArgumentCompleterCertificateCN
10271025
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'CertPath' -ScriptBlock $ArgumentCompleterCertPath
1028-
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'SignToolPath' -ScriptBlock $ArgumentCompleterSignToolPath
1026+
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'SignToolPath' -ScriptBlock $ArgumentCompleterExeFilePathsPicker
10291027
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'PolicyPaths' -ScriptBlock $ArgumentCompleterPolicyPathsBasePoliciesOnly
10301028
Register-ArgumentCompleter -CommandName 'Edit-SignedWDACConfig' -ParameterName 'SuppPolicyPaths' -ScriptBlock $ArgumentCompleterPolicyPathsSupplementalPoliciesOnly

‎WDACConfig/Edit-WDACConfig.psm1

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ function Edit-WDACConfig {
189189
Remove-Item -Path '.\ProgramDir_ScanResults*.xml' -Force -ErrorAction SilentlyContinue
190190
Remove-Item -Path ".\SupplementalPolicy$SuppPolicyName.xml" -Force -ErrorAction SilentlyContinue
191191
# An empty array that holds the Policy XML files - This array will eventually be used to create the final Supplemental policy
192-
[System.Array]$PolicyXMLFilesArray = @()
192+
[System.Object[]]$PolicyXMLFilesArray = @()
193193

194194
#Initiate Live Audit Mode
195195

@@ -267,7 +267,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
267267
Pause
268268

269269
# Store the program paths that user browses for in an array
270-
[System.Array]$ProgramsPaths = @()
270+
[System.Object[]]$ProgramsPaths = @()
271271
Write-Host "`nSelect program directories to scan" -ForegroundColor Cyan
272272
# Showing folder picker GUI to the user for folder path selection
273273
do {
@@ -393,7 +393,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
393393
# The notice about variable being assigned and never used should be ignored - it's being dot-sourced from Resources file
394394
[datetime]$Date = Get-Date
395395
# An empty array that holds the Policy XML files - This array will eventually be used to create the final Supplemental policy
396-
[System.Array]$PolicyXMLFilesArray = @()
396+
[System.Object[]]$PolicyXMLFilesArray = @()
397397

398398
################################### Initiate Live Audit Mode ###################################
399399

@@ -450,7 +450,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
450450
Pause
451451

452452
# Store the program paths that user browses for in an array
453-
[System.Array]$ProgramsPaths = @()
453+
[System.Object[]]$ProgramsPaths = @()
454454
Write-Host "`nSelect program directories to scan`n" -ForegroundColor Cyan
455455
# Showing folder picker GUI to the user for folder path selection
456456
do {
@@ -584,7 +584,7 @@ CiTool --update-policy "$((Get-Location).Path)\$PolicyID.cip" -json; Remove-Item
584584
# Any other attempts such as "Get-FileHash" or "Get-AuthenticodeSignature" fail and ConfigCI Module cmdlets totally ignore these files and do not create allow rules for them
585585

586586
# Finding the file(s) first and storing them in an array
587-
[System.Array]$ExesWithNoHash = @()
587+
[System.Object[]]$ExesWithNoHash = @()
588588
# looping through each user-selected path(s)
589589
foreach ($ProgramsPath in $ProgramsPaths) {
590590
# Making sure the currently processing path has any .exe in it

‎WDACConfig/Invoke-WDACSimulation.psm1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ function Invoke-WDACSimulation {
3333

3434
if ($FolderPath) {
3535
# Store the results of the Signed files
36-
[System.Array]$SignedResult = @()
36+
[System.Object[]]$SignedResult = @()
3737
# Get all of the files that WDAC supports from the user provided directory
3838
$CollectedFiles = (Get-ChildItem -Recurse -Path $FolderPath -File -Include '*.sys', '*.exe', '*.com', '*.dll', '*.ocx', '*.msp', '*.mst', '*.msi', '*.js', '*.vbs', '*.ps1', '*.appx').FullName
3939

@@ -134,7 +134,7 @@ function Invoke-WDACSimulation {
134134
}
135135

136136
# Create an empty array to store the output objects
137-
[System.Array]$FinalAllowedFilesOutputObject = @()
137+
[System.Object[]]$FinalAllowedFilesOutputObject = @()
138138

139139
# Loop through the first array and create output objects with the file path and source
140140
foreach ($path in $Hashresults) {

‎WDACConfig/New-DenyWDACConfig.psm1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ function New-DenyWDACConfig {
9090
# remove any possible files from previous runs
9191
Remove-Item -Path '.\ProgramDir_ScanResults*.xml' -Force -ErrorAction SilentlyContinue
9292
# An array to hold the temporary xml files of each user-selected folders
93-
[System.Array]$PolicyXMLFilesArray = @()
93+
[System.Object[]]$PolicyXMLFilesArray = @()
9494

9595
######################## Process Program Folders From User input #####################
9696
for ($i = 0; $i -lt $ScanLocations.Count; $i++) {
@@ -163,7 +163,7 @@ function New-DenyWDACConfig {
163163
elseif ($Drivers) {
164164

165165
powershell.exe {
166-
[System.Array]$DriverFilesObject = @()
166+
[System.Object[]]$DriverFilesObject = @()
167167
# loop through each user-selected folder paths
168168
foreach ($ScanLocation in $args[0]) {
169169
# DriverFile object holds the full details of all of the scanned drivers - This scan is greedy, meaning it stores as much information as it can find

‎WDACConfig/New-WDACConfig.psm1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -460,7 +460,7 @@ function New-WDACConfig {
460460
[System.String]$path = 'windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md'
461461

462462
[System.String]$ApiUrl = "https://api.github.com/repos/$owner/$repo/commits?path=$path"
463-
[System.Array]$Response = Invoke-RestMethod $ApiUrl
463+
[System.Object[]]$Response = Invoke-RestMethod $ApiUrl
464464
[datetime]$Date = $Response[0].commit.author.date
465465

466466
&$WriteLavender "`nThe document containing the drivers block list on GitHub was last updated on $Date"

0 commit comments

Comments
 (0)