Use Case

[Antonio-MIT]

Hello,

I am currently exploring using this tool to deploy WDAC, since I've noticed lots of errors when trying to form .CIP files from my Base.XML file - do you have much data as far as use cases?

[NathanJepson]

Hello Antonio (@Antonio-MIT ),

I could certainly help you with errors you are getting with your .CIP files, are you creating the Base.XML file using Microsoft's ConfigCI module? (https://learn.microsoft.com/en-us/powershell/module/configci/?view=windowsserver2025-ps )
Or this repo -- or perhaps some other tool?

With regards to your question regarding use-cases, are you referring to use-cases for Microsoft app control / WDAC generally, or use cases for this Git repo specifically? I could help you answer both questions. Just let me know.
Thanks!

[Antonio-MIT]

Hi, The WDAC implementation was something I've been exploring as a security project. I have tried the following: Create Base XML I've create the Base.XML multiple times, using multiple ACLs, in multiple directories using: * Powershell> Net-CIPolicy -Level Publisher -UserPEs -Fallback Hash * WDAC Wizard. REF: https://webapp-wdac-wizard.azurewebsites.net/ Convert Base XML to CIP This is partially where the hing is, when I try and convert the file, this "seems" to generate the .cip file, but... * Powershell > ConvertFrom-CIPolicy -XmlFilePath C:\WDAC\Base.xml -BinaryFilePath C:\WDAC\Base.cip Check Authentication Status Once I check the auth. Status of the .cip file, I get an "Unknown" - which seems to indicate that base .XML has tags in it that are corrupting the .XML to .BIN conversion? * Powershell > Get-AuthenticodeSignature .\Base.cip I am looking to try and use the WDAC-Framework tool to fix this, but does this seem familiar to you? Thanks for the reply. I starred your repo by-the-way!

…

________________________________ From: NathanJepson ***@***.***> Sent: Monday, March 9, 2026 11:44 PM To: NathanJepson/WDAC-Framework ***@***.***> Cc: Antonio M. Kornrumpf ***@***.***>; Mention ***@***.***> Subject: Re: [NathanJepson/WDAC-Framework] Use Case (Issue #1) [EXTERNAL SENDER] [https://avatars.githubusercontent.com/u/61210670?s=20&v=4]NathanJepson left a comment (NathanJepson/WDAC-Framework#1)<#1 (comment)> Hello Antonio ***@***.***<https://github.com/Antonio-MIT> ), I could certainly help you with errors you are getting with your .CIP files, are you creating the Base.XML file using Microsoft's ConfigCI module? (https://learn.microsoft.com/en-us/powershell/module/configci/?view=windowsserver2025-ps ) Or this repo -- or perhaps some other tool? With regards to your question regarding use-cases, are you referring to use-cases for Microsoft app control / WDAC generally, or use cases for this Git repo specifically? I could help you answer both questions. Just let me know. Thanks! — Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BOMA7SNMXJKXXNE2F47H6O34P6FTHAVCNFSM6AAAAACWLGA72SVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAMRYGQ2DSMZYGU>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[NathanJepson]

Hello Antonio ( @Antonio-MIT) ,

Yes, that problem is certainly familiar to me. You can't necessarily use Get-AuthenticodeSignature to check the signature of a WDAC policy.
You'll probably get an output that looks like:

SignerCertificate          Status                StatusMessage                                       Path
  -----------------         ------                -------------                                       ----
                       UnknownError    The form specified for the subject is not one supporte… {something}.cip

(This was my output when testing on a validly signed CIP file just now.)

The correct way to check the signature of a WDAC policy is something that I put in this PowerShell module file:
Resources\Code-Signing-Tools.psm1

In there, I put a function "Test-ValidP7SignedFile" which uses 2 methods to check a valid signature.
I pulled these 2 methods from Microsoft documentation somewhere, I can't remember.

You use both "certutil.exe" and the SignTool to verify that it's a valid signature.
When running certutil.exe to check the signature, it should give a verbose output that includes the common name of the certificate (that's usually the best indicator that the signing worked), as well as something that says "CertUtil: -asn command completed successfully."

$CertUtilResult = certutil.exe -asn $Path_of_Signed_CIP | Out-String

When doing the SignTool check, (which I've not included here)
This should give an output that says "Successfully verified...", etc.

Note: When running "Invoke-SignTool" or "Deploy-WDACPolicies" from WDAC-Framework, it will automatically call "Test-ValidP7SignedFile" for you to check that it has a valid signature.
Invoke-SignTool is a command you can use to sign a naked .CIP file that doesn't have a signature:
Invoke-SignTool -CIPPolicyPath "C:\users\user1\{60de5611-8845-471c-81ca-67f0e5b00e40}.cip" -DestinationDirectory "C:\users\user1\Downloads\"
(When running this command, you'll have to remove the ".p7" file extension at the end so it's only a .cip file.)

There is also a 3rd method you can use to verify that a signed .CIP file has a valid signature, and that's included at
Resources\Test-ValidWDACSignedPolicySignature.psm1
I usually copy this short little module to each remote device that I manage (yes, I actually use this repo in the real-world.)
Deploy-WDACPolicies will automatically call this function for you after the policy gets copied to remote devices.

Hopefully that resolves your concerns, let me know if there's anything else I can do to help you, Antonio.