Microsoft ConfigCI reference: Creates a Code Integrity policy as an .xml file. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for New-CIPolicy. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ConfigCI · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AllowFileNameFallbacks
Indicates that files that do not have an OriginalFileName fall back in the following order: - InternalName - FileDescription - ProductName
-AppIdTaggingKey
This parameter is reserved for future use.
-AppIdTaggingPolicy
This parameter is reserved for future use.
-AppIdTaggingValue
This parameter is reserved for future use.
-Audit
Indicates that this cmdlet searches the Code Integrity Audit log for drivers. It does not perform a full system scan. Specify this parameter only if you do not provide driver files or rules.
-Deny
Indicates that this cmdlet creates deny rules instead of the default allow rules.
-DriverFiles
Specifies an array of DriverFile objects on which this cmdlet bases rules. To obtain a driver file, use the Get-SystemDriver cmdlet.
-Fallback
Specifies an array of levels of detail for generated rules. If this cmdlet cannot generate a rule at the specified level, this cmdlet attempts to generate it at a fallback level. The acceptable values for this parameter are the same as for Level. If you specify multiple fallback levels, this cmdlet tries them in order.
-FilePath (required)
Specifies the path for the Code Integrity policy .xml file.
-Level (required)
Specifies the primary level of detail for generated rules. Refer to WDAC File Rule Levels for acceptable parameter values and descriptions.
-MultiplePolicyFormat
Indicates that this cmdlet should create a policy in multiple policy format as opposed to a single policy format. Refer to Create WDAC policies in Multiple Policy Format for the difference between the policy formats.
-NoScript
Indicates that this cmdlet does not search script files. It searches portable executable files (PE files) only. Specify this parameter only if you do not provide driver files or rules.
-NoShadowCopy
Indicates that the Volume Snapshot Service (VSS) does not make a shadow copy of the disk while the scan runs. This parameter could cause an incomplete scan for a system that is running. If a scan fails due to VSS errors caused by low disk space on the target drive, this cmdlet prompts you to specify this parameter.
-OmitPaths
Specifies an array of paths that this cmdlet omits from the search. Specify this parameter only if you do not provide driver files or rules. We recommend that you omit C:\Windows.old.
-PathToCatroot
Specifies the path of the CatRoot folder. Specify this parameter to scan a remote or mounted drive. Specify this parameter only if you do not provide driver files or rules.
-Rules (required)
Specifies an array of Rule objects that this cmdlet includes in the policy. To obtain a rule object, use the Get-CIPolicy or New-CIPolicyRule cmdlets.
-ScanPath
Specifies the path for this cmdlet to scan. You can specify a local or remote path. Specify this parameter only if you do not provide driver files or rules. If you specify a remote or mounted drive, also specify the PathToCatroot parameter.
-ScriptFileNames
This parameter is reserved for internal Microsoft use.
-SpecificFileNameLevel
Specifies the attribute of the file off which to base a file name rule. The -Level must be set to FileName for this option. Possible values are: None, OriginalFileName, InternalName, FileDescription, ProductName, PackageFamilyName, and FilePath. Refer to File Name Rules Info for a description of the acceptable values.
-UserPEs
Indicates that this cmdlet includes user-mode files in the scan. Specify this parameter only if you do not provide driver files or rules.
-UserWriteablePaths
Indicates that this cmdlet includes files identified as user writeable in the policy.
Prerequisites
Windows with the ConfigCI module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
Examples
Example 1: Create a policy in multiple policy format
The first command scans for user-mode executables (applications) along with kernel-mode binaries such as drivers and creates rules at the Publisher level. The command creates a policy in multiple policy format and stores it in the file that is named Policy.xml. This command specifies the OmitPaths parameter to exclude files in the temp\ConfigCITestBinaries folder. The command specifies the NoScript parameter so that it gets information for only portable executable files (PE files). Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.