Remove WDACConfig

Available Parameters of Remove-WDACConfig

Remove-WDACConfig -SignedBase

Remove-WDACConfig [-SignedBase] -PolicyPaths <String[]> -CertCN <String> [-SignToolPath <String>]

Uses the official procedure to Re-Deploy the Signed base WDAC policies with Enabled:Unsigned System Integrity Policy rule option.

Requires 3 mandatory parameters

• -PolicyPaths <String[]: Path to xml file(s) of the currently deployed policy that you want to remove, can be multiple. Supports tab completion by showing only .xml files.

• -SignToolPath <String>: You can use it in 2 different ways

• -CertCN <String>: Common name of the certificate used to sign the deployed WDAC policies - Supports argument completion so you don't have to manually enter the Certificate's CN, just make sure the certificate is installed in the personal store of the user certificates, then press TAB to auto complete the name. You can however enter it manually if you want to.

---

Remove-WDACConfig -UnsignedOrSupplemental

Remove-WDACConfig [-UnsignedOrSupplemental] [-PolicyIDs <String[]>] [-PolicyNames <String[]>]

Removes Unsigned deployed WDAC policies as well as Signed deployed Supplemental WDAC policies

Has 2 parameters

• -PolicyIDs <String[]>
• -PolicyNames <String[]>

You can choose either of them or both of them, at the same time, but you do need to use one of them at least.

They use argument completion with ValidateSet, meaning you can't specify wrong PolicyIDs or PolicyNames, just press TAB key and it will autofill the arguments for you based on the deployed policies. If you want to select multiple items, after each one, enter a comma , and then press TAB again to choose another Name/ID.

For example, you can specify 2 policies by IDs and 3 policies by names, and it will automatically remove all of them.

Hint: First use -ListActivePolicies parameter to list the deployed policies on the screen.

Hint 2: When using -PolicyNames <String[]> parameter, if multiple policies with the exact same name are deployed, when you press TAB, you will only see 1 of them, if you select it, all of the policies with that name will be removed. If that's not desired, consider using -PolicyIDs <String[]> parameter instead.

The logic behind -SignToolPath <String> optional parameter

1. If Windows SDK Signing Tools for Desktop Apps components is installed in the default location C:\Program Files (x86)\Windows Kits, then -SignToolPath <String> parameter isn't necessary.

2. If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you use the -SignToolPath <String> parameter.