Add-Hgs Attestation CIPolicy

Syntax

Add-HgsAttestationCIPolicy
   [-InputObject] <Byte[]>
   -Name <String>
   [-PolicyVersion <PolicyVersion>]
   [-Stage]
   [-WhatIf]
   [-Confirm]

Add-HgsAttestationCIPolicy
   [-Path] <String>
   [-Name <String>]
   [-PolicyVersion <PolicyVersion>]
   [-Stage]
   [-WhatIf]
   [-Confirm]

Description

The Add-HgsAttestationCIPolicy cmdlet adds an attestation policy based on a trusted code integrity policy to HGS. When HGS is configured to use TPM attestation, hosts will need to use one of the code integrity policies registered with HGS to successfully pass attestation. Use the New-CIPolicy and ConvertFrom-CIPolicy cmdlets to create a binary code integrity policy that can be passed to this cmdlet.

HGS will not know which software is allowed or disallowed by your policy, nor will it know which policy rules (e.g. enforced CI, reboot actions) are configured in the policy. You should choose a descriptive name for your policy to ensure you know what your policy covers for future reference when reviewing authorized policies.

Examples

Example 1

PS C:\> Add-HgsAttestationCIPolicy -Path C:\temp\WS2016-Enforced.p7b -Name "Windows Server 2016 Enforced CI Policy"

Adds the binary code integrity policy file to HGS and names the policy "Windows Server 2016 Enforced CI Policy"

Required Parameters

Optional Parameters

Inputs

Byte[], System.String

This cmdlet accepts a code integrity policy as a Byte array or filename.

Outputs

AttestationPolicyInfo

This cmdlet returns attestation policy information.