Website under construction

Create code integrity policy for lockdown server 
It is a similar process to create the code integrity policy on this category of servers, but with different 
level of control on the software you trust. For this type of server, we recommend using FilePublisher, 
to ensure only whitelisted files can be loaded on the server. To create the Code Integrity policy, run 
the following cmdlet: 
New-CIPolicy -Level FilePublisher -Fallback Hash -UserPEs -FilePath C:\CI\FilePublisher.xml 
This cmdlet creates the policy by scanning the files on the server and creates a safe-program list of 
the files by their name, version, and publisher info in the policy. Only the files are on the safe-program 
list with matching name, publisher, and version equal or greater is considered as trusted. In the case 
of software update, the update to the files covered by the policy will have a higher version number; 
therefore, you won’t need to regenerate CI policy. If there are new files added to the server, you will 
need to scan the new files, and merge it to the existing CI policy. 
The cmdlet creates the policy in Audit mode, you can validate the policy in the Audit mode first, 
ensuring that all the files you trust are covered by the CI policy. After you are comfortable with it, you 
can run the following cmdlet to change it to enforcement mode: 
Set-RuleOptions -FilePath C:\CI\FilePublisher.xml -Option 3 -delete 
Deploy code integrity policy 
The xml file created by the New-CIPolicy can’t be consumed by the system yet. To deploy the policy, it 
needs to be converted to binary format, and copied to the CodeIntegrity folder under system32. 
Run the following cmdlet to convert the xml file: 
ConvertFrom-CIPolicy C:\CI\FilePublisher.xml C:\CI\FilePublisher.bin 
Deploy CI policy: 
Copy-Item C:\CI\FilePublisher.bin C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 
Reboot the server to allow code integrity service to load the policy.
More info For some basic information on how to get started with Code Integrity policies as well 
as further information about creating an audit policy and deploying it via Group Policy, go to 
https://technet.microsoft.com/library/mt463091(v=vs.85).aspx#code_integrity_policies
.