New-CMWdacSetting
Create a Microsoft Defender Application Control settings policy object.
Syntax
Default (Default)
New-CMWdacSetting
[-EnforcementMode <CMWDACEnforcementMode>]
[-EnforceRestart <Boolean>]
[-EnableIntelligentSecurityGraph]
[-TrustedFolders <DirectoryInfo[]>]
[-TrustedFiles <FileInfo[]>]
-Name <String>
[-Description <String>]
[-DisableWildcardHandling]
[-ForceWildcardHandling]
[<CommonParameters>]
Description
Create a Microsoft Defender Application Control settings policy object.
Use the New-CMSettingDeployment cmdlet to deploy this setting to a collection.
Examples
Example 1: New audit mode Application Control policy
This example creates a new policy object to put Application Control in audit mode.
New-CMWdacSetting -Name "NewAudit" -EnforcementMode AuditMode
Example 2: New policy that doesn't reboot the client
This example creates a new policy that doesn't force the client to restart when it applies the policy.
New-CMWdacSetting -Name "NewNoReboot" -EnforceRestart $false
Example 3: New policy custom trusted binaries
This example creates a new policy that adds specific files to the list of trusted files.
New-CMWdacSetting -Name "NewTrustedFiles" -TrustedFiles "abc.exe", "xyz.dll"
Parameters
-Description
Specify an optional description to better identify this policy.
Parameter properties
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-DisableWildcardHandling
This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.
Parameter properties
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-EnableIntelligentSecurityGraph
Add this parameter to authorize software that the Microsoft Intelligent Security Graph trusts. This service includes Windows Defender SmartScreen and other Microsoft services. For this software to be trusted, the device must be running Windows Defender SmartScreen and Windows 10 version 1709 or later.
Parameter properties
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-EnforcementMode
Choose one of the following enforcement methods for Microsoft Defender Application Control:
EnforceMode: Only trusted executables can run.AuditMode: Allow all executables to run. Add an entry to the Windows event log when untrusted executables run.
Parameter properties
| Type: | CMWDACEnforcementMode |
| Default value: | None |
| Accepted values: | AuditMode, EnforceMode |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-EnforceRestart
After the client processes the policy, a restart is scheduled on the client. It follows the client settings for Computer Restart. Applications currently running on the device won't have the new Application Control policy applied to them until after the device restarts.
Set this parameter to $true to force the device to restart after the client applies the policy.
Parameter properties
| Type: | Boolean |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ForceWildcardHandling
This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.
Parameter properties
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Name
Specify a name for this policy to identify it.
Parameter properties
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-TrustedFiles
Add trust for specific files.
Parameter properties
| Type: | FileInfo[] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-TrustedFolders
Add trust for specific folders.
Parameter properties
| Type: | DirectoryInfo[] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.