The New-CIPolicyRule cmdlet from the ConfigCI module is used to generate Code Integrity (CI) policy rules for drivers or specific file paths. You can specify the level of detail for the rules (e.g., Publisher, Hash, FileName) and provide either an array of DriverFile objects or a specific driver file path.
Key Concepts
- Rule Levels: You define how strictly a rule is applied using the
-Level parameter. Common levels include Publisher, Hash, FileName, and FilePath. - Fallback Mechanism: If the cmdlet cannot generate a rule at your primary
-Level, you can use the -Fallback parameter to specify alternative levels to attempt in order. - Allow vs. Deny: By default, the cmdlet creates 'Allow' rules. Use the
-Deny switch to create 'Deny' rules instead.
# Example: Create policy rules for drivers using Get-SystemDriver
$DriverFiles = Get-SystemDriver -ScanPath '.\temp\' -UserPEs -OmitPaths '.\temp\ConfigCITestBinaries' -NoScript
New-CIPolicyRule -Level FileName -DriverFiles $DriverFiles