Deploying Supplemental Policy on Endpoint

Use this task to create and deploy a signed Windows Defender Application Control (WDAC) supplemental policy on the endpoint using a controlled and secure approach. This supplemental policy is generated as a separate policy file and is linked to an existing base policy using the provided base policy GUID.

About this task

The task performs the following actions:

• Accepts the rule input in either Single-Level or Multi-Level (CSV) format.
• Generates WDAC rules based on file attributes such as hash, publisher, file path or file name.
• Creates a new supplemental policy using multiple policy format.
• Links the newly created supplemental policy to the specified base policy GUID.
• Supports enforced and audit execution modes.
• Converts the policy from XML to binary *.cip format.
• Signs the policy using a trusted code-signing certificate.
• Mounts the EFI system partition to deploy the policy.
• Copies the signed policy to the EFI\Microsoft\Boot\CiPolicies\Active location.
• Ensures each execution creates a new unique supplemental policy without modifying existing policies.
• Logs execution details (success/failure) to the BAC\Logs\Deploy_WDAC_SuppPolicy.log location.

Refer to the table below to know more about the task's exit code.

Table 1. Exit Codes Table

Exit Code	Meaning
0	Success
20	Missing base policy GUID
30	No valid rules generated
40	Signing failure or invalid signed output