COMMAND EVERYTHING.

Add-SignerRule

Creates a signer rule and adds it to a policy.

PowerShell · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft ConfigCI reference: Creates a signer rule and adds it to a policy. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Add-SignerRule -FilePath <String> -CertificatePath <String> [-Kernel] [-User] [-Update] [-Supplemental] [-Deny]
 [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Add-SignerRule. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / ConfigCI · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-CertStorePath (required): Specifies the path to a certificate store to export certificates into the policy.
-CertificatePath (required): Specifies the path of a certificate (.cer) file that this cmdlet uses for the rule.
-Deny: Indicates that this cmdlet creates a deny rule instead of the default allow rule.
-FilePath (required): Specifies the path of the policy .xml file to which this cmdlet adds the rule.
-Kernel: Indicates that this cmdlet adds the rule as a Kernel mode rule. You can add a rule as more than one scenario.
-Supplemental: Indicates that this cmdlet adds the rule as a Supplemental policy signers rule. You can add a rule as more than one scenario.
-Update: Indicates that this cmdlet adds the rule as an Update policy signers rule. You can add a rule as more than one scenario. Update policy signers rules to determine which signers can sign a policy in signed policy scenario.
-User: Indicates that this cmdlet adds the rule as a User mode rule. You can add a rule as more than one scenario.

Prerequisites

Windows with the ConfigCI module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1: Create and add a signer rule for User mode

Add-SignerRule -FilePath '.\Policy.xml' -CertificatePath '.\certificate07.cer' -User

This command generates a signer rule for the certificate in certificate07.cer. The command adds the rule to policy.xml for the User mode scenario. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/ConfigCI/Add-SignerRule.md

https://learn.microsoft.com/powershell/module/configci/add-signerrule?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands