Powershell wrapper for citool.exe

[iainfm]

Hi,

I thought I'd share this here in case it's of any use to anyone.

I've written a little Powershell module (my first ever!) that puts verb-noun cmdlets around the citool.exe commands. I created it mainly because I don't like how citool.exe requires a key to be pressed after running, and so I could output (and process) only the information I want to see.

For example:

(Get-CIPolicies |? {$_.IsEnforced -eq $True}).FriendlyName

or

(Get-CIPolicies |? {$_.IsEnforced -eq $False}) | Select PolicyID, BasePolicyID, Version

All of the citool.exe options are supported, but I have not yet tested the token addition/removal ones.

Use at your own risk etc etc.

The psm1 file is available in my GitHub repository

[iainfm]

I've also added a script to pull down the latest MS Learn document and extract the recommended block rules XML from it. Hopefully this will be provided as a downloadable link soon, but until then there's this.

https://github.com/iainfm/CItool-PSWrapper/blob/main/Get-MSBlockList.ps1

[Harvester57]

Improvement idea: add the recommended denylist for drivers, in addition to the usermode processes denylist :)

[iainfm]

You can do this with the script as-is, using the -Url option, eg

Get-MSBlockList.ps1 -Url https://raw.githubusercontent.com/MicrosoftDocs/windows-itpro-docs/7a639741a199115563a05f3f458ad500a80f4100/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md -FilePath .\driverblockrules.xml

Hopefully we'll not need these for much longer though as they're the default in Win11 22H2, according to #217

[HotCakeX]

because I don't like how citool.exe requires a key to be pressed after running

You just need to use -json parameter. That's what I do in my module. It outputs objects that work natively in PowerShell.

(CiTool -lp -json | ConvertFrom-Json).Policies