citool.exe log file

[eraldinho]

Hello,

there is an error when I try to add a policy with citool --update-policy : An error occurred: 0x8007023E

There is no more explanation et I have no clue of what this error mean. I've tried to find information in theses log but it seem there is nothing :

• Applications and Services logs - Microsoft - Windows - CodeIntegrity - Verbose
• Applications and Services logs - Microsoft - Windows - AppLocker - EXE and DLL
• Applications and Services logs - Microsoft - Windows - AppLocker - Packaged app-Deployment
• Applications and Services logs - Microsoft - Windows - AppLocker - Packaged app-Execution
• Applications and Services logs - Microsoft - Windows - AppID - Operational
• Applications and Services logs - Microsoft - Windows - CAPI2 - Operational
• Applications and Services logs - Microsoft - Windows - DeviceGuard - Operational
• Applications and Services logs - Microsoft - Windows - PowerShell - *
• Windows - Application
• Windows - System

is there a specific log file for citool.exe? (no information on this page : https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/citool-commands)

thanks for help.

Erald

[HotCakeX]

It looks a generic application error, I've never seen it before. You're running it as Admin, right?
You can take a clean Hyper-V VM, run the Citool with that parameter on it and you will see it'll work fine. Then start applying any customizations or configurations you've applied on your problematic system until you find the root cause of it.

[eraldinho]

Hello,

yes I have run citool in an admin powershell and in an (almost) fresh W11 Pro 24h2 virtual machine. I tried today in and admin command prompt (not powershel) and it worked. I ran this command again in an admin powershell an I still got the error.

I'm playing with wdac to increase my skills, and on this VM I only deployed 4 policies :

• Microsoft Windows Driver Policy - Enforced
• AllowMicrosoft
• Microsoft Windows Recommended User Mode BlockList
• DefaultWindowsAudit (Audit Mode)

then I ran wireguard-installer.exe which was blocked by AllowMicrosoft policie (saw this with ConvertTo-WDACPolicy -LogType Blocked)
and finally I ran ConvertTo-WDACPolicy -policyToAddLogsTo to modify AllowMicrosoft policie.

And now when I want to deploy my modified AllowMicrosoft - 10-25-2024 with citool I have this error (with powershell everytime et with cmd sometimes).

I have no clue of what is the problem but I managed to deploy my policie.

[HotCakeX]

I'll definitely look into it.

What do you think about using the new AppControl manager app to do what you are doing with WDACConfig module? Soon i'm adding the ConvertTo-WDACPolicy function along with Edit-WDACConfig and deployment feature to it.

I had some users telling me the PowerShell cmdlets were a bit complicated and i agree because there are lots of parameters and it's a bit hard to figure out which one to use, but App Control manager has a modern GUI and solves that problem.

Everything in AppControl manager is also significantly faster than the PowerShell module.

So if you have any feedback or feature you want to see implemented in it let me know.

[eraldinho]

in my opinion WDACConfig module is awesome and you did a very good job with de documentation. In this case, My issue is with citool.exe, do you think it could be because of a bad use of ConvertTo-WDACPolicy from myself (the policie file could be faulty in some way)? It is possible as I'm very new to wdac et WDACConfig module.
I usually prefer to use command line than GUI, but I can try the AppControl manage.
I wonder, are you part of the citool.exe development team?

[HotCakeX]

Thank you, I really don't think that a policy you deployed could've caused it because the most restrictive one the module offers is "Default Windows" and it allows CiTool.exe to run.

I'm releasing a very big update to the AppControl Manager soon, it's gonna be so much easy to use AppControl on your computer. Stay tuned for it!

And no i'm not part of the Citool.exe dev team.