Set-RuleOption

Module:

ConfigCI

Modifies rule options in a Code Integrity policy.

Syntax

Set-RuleOption
   [-Delete]
   [-FilePath] <String>
   [-Option] <Int32>
   [<CommonParameters>]

Set-RuleOption
   [-Help]
   [<CommonParameters>]

Description

The Set-RuleOption cmdlet modifies rule options in a Code Integrity policy. Rule options appear under the Rules property in the .xml policy file. To see the available rule options and their indexes, specify the Help parameter. This cmdlet adds the option that you specify by index. To remove a rule option, specify the Delete parameter.

Examples

Example 1: Remove a rule option

The first command displays the contents of the policy. This example shows only the first few lines of the policy, which include the **Rules** property. One of the options displayed is Enabled:Audit Mode.
PS C:\> Get-Content -Path '.Policy.xml'
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Audit Mode</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Advanced Boot Options Menu</Option>
    </Rule>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
  </Rules>

The second command removes the Enabled:Audit Mode from Policy.xml.The final command displays the contents of the policy again. Enabled:Audit Mode is no longer part of the policy.
PS C:\> Set-RuleOption -FilePath '.\Policy.xml' -Option 3 -Delete 
PS C:\> Get-Content -Path '.Policy.xml'
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>
      <Option>Enabled:Advanced Boot Options Menu</Option>
    </Rule>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
  </Rules>

This example removes Enabled:Audit Mode from a policy.

Parameters

-Delete

Indicates that this cmdlet removes the rule option that the Option parameter specifies.

Type:	SwitchParameter
Aliases:	d
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-FilePath

Specifies the path of the policy .xml file that this cmdlet modifies.

Type:	String
Aliases:	f
Position:	0
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Help

Indicates that this cmdlet displays the list of available options and their indexes.

Type:	SwitchParameter
Aliases:	h
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Option

Specifies the index of the rule option that this cmdlet modifies. Specify the Help parameter for option information. Refer to WDAC Policy Rule Options for more detailed descriptions of each option.

Type:	Int32
Aliases:	o
Position:	1
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

Related Links

• Set-HVCIOptions