Skip to content

Commit cc6b732

Browse files
shortthirdmanShortThirdMan USA Inc
shortthirdman
authored and
ShortThirdMan USA Inc
committed
Microsoft Windows DG Readiness Tool
1 parent e1e8d7b commit cc6b732

6 files changed

+2165
-0
lines changed

‎dgreadiness_v3.6/DG_Readiness_Tool_v3.6.ps1

+1,539
Large diffs are not rendered by default.

‎dgreadiness_v3.6/DefaultWindows_Audit.xml

+265
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
3+
<VersionEx>10.0.0.0</VersionEx>
4+
<PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
5+
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
6+
<Rules>
7+
<Rule>
8+
<Option>Enabled:Unsigned System Integrity Policy</Option>
9+
</Rule>
10+
<Rule>
11+
<Option>Enabled:Audit Mode</Option>
12+
</Rule>
13+
<Rule>
14+
<Option>Enabled:Advanced Boot Options Menu</Option>
15+
</Rule>
16+
<Rule>
17+
<Option>Enabled:UMCI</Option>
18+
</Rule>
19+
<Rule>
20+
<Option>Enabled:Inherit Default Policy</Option>
21+
</Rule>
22+
<Rule>
23+
<Option>Enabled:Update Policy No Reboot</Option>
24+
</Rule>
25+
</Rules>
26+
27+
<!--EKUS-->
28+
<EKUs>
29+
<EKU ID="ID_EKU_WINDOWS" Value="010A2B0601040182370A0306" />
30+
<EKU ID="ID_EKU_WHQL" Value="010A2B0601040182370A0305" />
31+
<EKU ID="ID_EKU_ELAM" Value="010A2B0601040182373D0401" />
32+
<EKU ID="ID_EKU_HAL_EXT" Value="010a2b0601040182373d0501" />
33+
<EKU ID="ID_EKU_RT_EXT" Value="010a2b0601040182370a0315" />
34+
<EKU ID="ID_EKU_STORE" FriendlyName="Windows Store EKU - 1.3.6.1.4.1.311.76.3.1 Windows Store" Value="010a2b0601040182374c0301" />
35+
<EKU ID="ID_EKU_DCODEGEN" FriendlyName="Dynamic Code Generation EKU - 1.3.6.1.4.1.311.76.5.1" Value="010A2B0601040182374C0501" />
36+
<EKU ID="ID_EKU_AM" FriendlyName="AntiMalware EKU -1.3.6.1.4.1.311.76.11.1 " Value="010a2b0601040182374c0b01" />
37+
</EKUs>
38+
39+
<!--Signers-->
40+
<Signers>
41+
<Signer ID="ID_SIGNER_WINDOWS_PRODUCTION" Name="Microsoft Product Root 2010 Windows EKU">
42+
<CertRoot Type="Wellknown" Value="06" />
43+
<CertEKU ID="ID_EKU_WINDOWS" />
44+
</Signer>
45+
<Signer ID="ID_SIGNER_ELAM_PRODUCTION" Name="Microsoft Product Root 2010 ELAM EKU">
46+
<CertRoot Type="Wellknown" Value="06" />
47+
<CertEKU ID="ID_EKU_ELAM" />
48+
</Signer>
49+
50+
<Signer ID="ID_SIGNER_HAL_PRODUCTION" Name="Microsoft Product Root 2010 HAL EKU">
51+
<CertRoot Type="Wellknown" Value="06" />
52+
<CertEKU ID="ID_EKU_HAL_EXT" />
53+
</Signer>
54+
55+
<Signer ID="ID_SIGNER_WHQL_SHA2" Name="Microsoft Product Root 2010 WHQL EKU">
56+
<CertRoot Type="Wellknown" Value="06" />
57+
<CertEKU ID="ID_EKU_WHQL" />
58+
</Signer>
59+
60+
<Signer ID="ID_SIGNER_WHQL_SHA1" Name="Microsoft Product Root WHQL EKU SHA1">
61+
<CertRoot Type="Wellknown" Value="05" />
62+
<CertEKU ID="ID_EKU_WHQL" />
63+
</Signer>
64+
65+
<Signer ID="ID_SIGNER_WHQL_MD5" Name="Microsoft Product Root WHQL EKU MD5">
66+
<CertRoot Type="Wellknown" Value="04" />
67+
<CertEKU ID="ID_EKU_WHQL" />
68+
</Signer>
69+
70+
<Signer ID="ID_SIGNER_WINDOWS_PRODUCTION_USER" Name="Microsoft Product Root 2010 Windows EKU">
71+
<CertRoot Type="Wellknown" Value="06" />
72+
<CertEKU ID="ID_EKU_WINDOWS" />
73+
</Signer>
74+
75+
<Signer ID="ID_SIGNER_ELAM_PRODUCTION_USER" Name="Microsoft Product Root 2010 ELAM EKU">
76+
<CertRoot Type="Wellknown" Value="06" />
77+
<CertEKU ID="ID_EKU_ELAM" />
78+
</Signer>
79+
80+
<Signer ID="ID_SIGNER_HAL_PRODUCTION_USER" Name="Microsoft Product Root 2010 HAL EKU">
81+
<CertRoot Type="Wellknown" Value="06" />
82+
<CertEKU ID="ID_EKU_HAL_EXT" />
83+
</Signer>
84+
85+
<Signer ID="ID_SIGNER_WHQL_SHA2_USER" Name="Microsoft Product Root 2010 WHQL EKU">
86+
<CertRoot Type="Wellknown" Value="06" />
87+
<CertEKU ID="ID_EKU_WHQL" />
88+
</Signer>
89+
90+
<Signer ID="ID_SIGNER_WHQL_SHA1_USER" Name="Microsoft Product Root WHQL EKU SHA1">
91+
<CertRoot Type="Wellknown" Value="05" />
92+
<CertEKU ID="ID_EKU_WHQL" />
93+
</Signer>
94+
95+
<!-- Flighting related signers -->
96+
<Signer ID="ID_SIGNER_WINDOWS_FLIGHT_ROOT" Name="Microsoft Flighting Root 2014 Windows EKU">
97+
<CertRoot Type="Wellknown" Value="0E" />
98+
<CertEKU ID="ID_EKU_WINDOWS" />
99+
</Signer>
100+
101+
<Signer ID="ID_SIGNER_ELAM_FLIGHT" Name="Microsoft Flighting Root 2014 ELAM EKU">
102+
<CertRoot Type="Wellknown" Value="0E" />
103+
<CertEKU ID="ID_EKU_ELAM" />
104+
</Signer>
105+
106+
<Signer ID="ID_SIGNER_HAL_FLIGHT" Name="Microsoft Flighting Root 2014 HAL EKU">
107+
<CertRoot Type="Wellknown" Value="0E" />
108+
<CertEKU ID="ID_EKU_HAL_EXT" />
109+
</Signer>
110+
111+
<Signer ID="ID_SIGNER_WHQL_FLIGHT_SHA2" Name="Microsoft Flighting Root 2014 WHQL EKU">
112+
<CertRoot Type="Wellknown" Value="0E" />
113+
<CertEKU ID="ID_EKU_WHQL" />
114+
</Signer>
115+
116+
<Signer ID="ID_SIGNER_WINDOWS_FLIGHT_ROOT_USER" Name="Microsoft Flighting Root 2014 Windows EKU">
117+
<CertRoot Type="Wellknown" Value="0E" />
118+
<CertEKU ID="ID_EKU_WINDOWS" />
119+
</Signer>
120+
121+
<Signer ID="ID_SIGNER_ELAM_FLIGHT_USER" Name="Microsoft Flighting Root 2014 ELAM EKU">
122+
<CertRoot Type="Wellknown" Value="0E" />
123+
<CertEKU ID="ID_EKU_ELAM" />
124+
</Signer>
125+
126+
<Signer ID="ID_SIGNER_HAL_FLIGHT_USER" Name="Microsoft Flighting Root 2014 HAL EKU">
127+
<CertRoot Type="Wellknown" Value="0E" />
128+
<CertEKU ID="ID_EKU_HAL_EXT" />
129+
</Signer>
130+
131+
<Signer ID="ID_SIGNER_WHQL_FLIGHT_SHA2_USER" Name="Microsoft Flighting Root 2014 WHQL EKU">
132+
<CertRoot Type="Wellknown" Value="0E" />
133+
<CertEKU ID="ID_EKU_WHQL" />
134+
</Signer>
135+
136+
<Signer ID="ID_SIGNER_WHQL_MD5_USER" Name="Microsoft Product Root WHQL EKU MD5">
137+
<CertRoot Type="Wellknown" Value="04" />
138+
<CertEKU ID="ID_EKU_WHQL" />
139+
</Signer>
140+
141+
<Signer ID="ID_SIGNER_STORE" Name="Microsoft MarketPlace PCA 2011">
142+
<CertRoot Type="TBS" Value="FC9EDE3DCCA09186B2D3BF9B738A2050CB1A554DA2DCADB55F3F72EE17721378" />
143+
<CertEKU ID="ID_EKU_STORE" />
144+
</Signer>
145+
146+
<Signer ID="ID_SIGNER_RT_PRODUCTION" Name="Microsoft Product Root 2010 RT EKU">
147+
<CertRoot Type="Wellknown" Value="06" />
148+
<CertEKU ID="ID_EKU_RT_EXT" />
149+
</Signer>
150+
151+
<Signer ID="ID_SIGNER_RT_FLIGHT" Name="Microsoft Flighting Root 2014 RT EKU">
152+
<CertRoot Type="Wellknown" Value="0E" />
153+
<CertEKU ID="ID_EKU_RT_EXT" />
154+
</Signer>
155+
156+
<Signer ID="ID_SIGNER_RT_STANDARD" Name="Microsoft Standard Root 2001 RT EUK">
157+
<CertRoot Type="Wellknown" Value="07" />
158+
<CertEKU ID="ID_EKU_RT_EXT" />
159+
</Signer>
160+
161+
<Signer ID="ID_SIGNER_TEST2010" Name="MincryptKnownRootMicrosoftTestRoot2010">
162+
<CertRoot Type="Wellknown" Value="0A" />
163+
</Signer>
164+
165+
<Signer ID="ID_SIGNER_TEST2010_USER" Name="MincryptKnownRootMicrosoftTestRoot2010">
166+
<CertRoot Type="Wellknown" Value="0A" />
167+
</Signer>
168+
169+
<Signer ID="ID_SIGNER_DRM" Name="MincryptKnownRootMicrosoftDMDRoot2005">
170+
<CertRoot Type="Wellknown" Value="0C" />
171+
</Signer>
172+
173+
<Signer ID="ID_SIGNER_DCODEGEN" Name="MincryptKnownRootMicrosoftProductRoot2010">
174+
<CertRoot Type="Wellknown" Value="06" />
175+
<CertEKU ID="ID_EKU_DCODEGEN" />
176+
</Signer>
177+
178+
<Signer ID="ID_SIGNER_AM" Name="MincryptKnownRootMicrosoftStandardRoot2011">
179+
<CertRoot Type="Wellknown" Value="07" />
180+
<CertEKU ID="ID_EKU_AM" />
181+
</Signer>
182+
</Signers>
183+
184+
<SigningScenarios>
185+
<!--Kernel Mode Signing Scenario-->
186+
<SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_KMCI" FriendlyName="Kernel Mode Signing Scenario">
187+
<ProductSigners>
188+
<AllowedSigners>
189+
<AllowedSigner SignerId="ID_SIGNER_WINDOWS_PRODUCTION" />
190+
<AllowedSigner SignerId="ID_SIGNER_ELAM_PRODUCTION" />
191+
<AllowedSigner SignerId="ID_SIGNER_HAL_PRODUCTION" />
192+
<AllowedSigner SignerId="ID_SIGNER_WHQL_SHA2" />
193+
<AllowedSigner SignerId="ID_SIGNER_WHQL_SHA1" />
194+
<AllowedSigner SignerId="ID_SIGNER_WHQL_MD5" />
195+
<AllowedSigner SignerId="ID_SIGNER_WINDOWS_FLIGHT_ROOT" />
196+
<AllowedSigner SignerId="ID_SIGNER_ELAM_FLIGHT" />
197+
<AllowedSigner SignerId="ID_SIGNER_HAL_FLIGHT" />
198+
<AllowedSigner SignerId="ID_SIGNER_WHQL_FLIGHT_SHA2" />
199+
<!-- Test signer is trusted by ConfigCI, however, it will not be trusted by CI unless testsigning BCD is set -->
200+
<AllowedSigner SignerId="ID_SIGNER_TEST2010"/>
201+
</AllowedSigners>
202+
</ProductSigners>
203+
</SigningScenario>
204+
205+
<!--User Mode Signing Scenario-->
206+
<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_UMCI" FriendlyName="User Mode Signing Scenario">
207+
<ProductSigners>
208+
<AllowedSigners>
209+
<AllowedSigner SignerId="ID_SIGNER_WINDOWS_PRODUCTION_USER" />
210+
<AllowedSigner SignerId="ID_SIGNER_ELAM_PRODUCTION_USER" />
211+
<AllowedSigner SignerId="ID_SIGNER_HAL_PRODUCTION_USER" />
212+
<AllowedSigner SignerId="ID_SIGNER_WHQL_SHA2_USER" />
213+
<AllowedSigner SignerId="ID_SIGNER_WHQL_SHA1_USER" />
214+
<AllowedSigner SignerId="ID_SIGNER_WHQL_MD5_USER" />
215+
<AllowedSigner SignerId="ID_SIGNER_WINDOWS_FLIGHT_ROOT_USER" />
216+
<AllowedSigner SignerId="ID_SIGNER_ELAM_FLIGHT_USER" />
217+
<AllowedSigner SignerId="ID_SIGNER_HAL_FLIGHT_USER" />
218+
<AllowedSigner SignerId="ID_SIGNER_WHQL_FLIGHT_SHA2_USER" />
219+
<AllowedSigner SignerId="ID_SIGNER_STORE" />
220+
<AllowedSigner SignerId="ID_SIGNER_RT_PRODUCTION" />
221+
<AllowedSigner SignerId="ID_SIGNER_DRM" />
222+
<AllowedSigner SignerId="ID_SIGNER_DCODEGEN" />
223+
<AllowedSigner SignerId="ID_SIGNER_AM" />
224+
<AllowedSigner SignerId="ID_SIGNER_RT_FLIGHT" />
225+
<AllowedSigner SignerId="ID_SIGNER_RT_STANDARD" />
226+
<!-- Test signer is trusted by ConfigCI, however, it will not be trusted by CI unless testsigning BCD is set -->
227+
<AllowedSigner SignerId="ID_SIGNER_TEST2010_USER"/>
228+
</AllowedSigners>
229+
</ProductSigners>
230+
</SigningScenario>
231+
</SigningScenarios>
232+
<UpdatePolicySigners>
233+
</UpdatePolicySigners>
234+
<!--
235+
236+
CiSigners are signers that ConfigCI asks CI to trust for all builds, include
237+
retail builds.
238+
239+
Normally CiSigners is empty or only includes production signers. For enterprise
240+
ConfigCI policy, you may need to include enterprise signers. Just make sure it
241+
is understood that CiSigners will be trusted by CI for all builds.
242+
243+
-->
244+
<CiSigners>
245+
<!--
246+
Currently Centennial Apps are launched as Win32 Apps and signed by store certificate.
247+
We need to allow enterprise signing scenario to trust store certificate.
248+
-->
249+
<CiSigner SignerId="ID_SIGNER_STORE" />
250+
</CiSigners>
251+
252+
<HvciOptions>0</HvciOptions>
253+
<Settings>
254+
<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
255+
<Value>
256+
<String>DefaultWindowsAudit</String>
257+
</Value>
258+
</Setting>
259+
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
260+
<Value>
261+
<String>031017</String>
262+
</Value>
263+
</Setting>
264+
</Settings>
265+
</SiPolicy>

‎dgreadiness_v3.6/DefaultWindows_Audit_sipolicy.p7b

2.26 KB
Binary file not shown.

0 commit comments

Comments
 (0)