<settings pass="specialize">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>cmd /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f</Path>
                    <Description>Disable Smart App Control before OOBE</Description>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>

Once you deploy that, Secure boot requires the file or newer to be on the EFI partition.

It's there now, forever, or until you reset secure boot. During re-imaging you can copy the latest version after apply OS with a script like this

$tsenv = New-Object -ComObject Microsoft.SMS.TSEnvironment
$osdisk = $tsenv.Value("OSDisk")

$PolicyBinary = $OSDisk+"\Windows\System32\SecureBootUpdates\SkuSiPolicy.p7b"
$MountPoint = 's:'

$EFIDestinationFolder = "$MountPoint\EFI\Microsoft\Boot"

if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force }

Copy-Item -Path $PolicyBinary -Destination $EFIDestinationFolder -Force

Just a quick post to hopefully save someone some time. Ask me anything, I may have skipped over something.

Setup

Download Scripts

Create a base policy (base.xml), and supplemental policies, ideally 2 (SOE.xml and ThirdParty.xml) for the current setup, you can hack at the scripts to do your own thing.
Copy the XMLs to Policies\Base, Policies\SOE, Policies\ThirdParty.

Create Policy

To add a new app to wdac you use the createPolicy.ps1

.\CreatePolicy.ps1 -scanpath "C:\temp\Citrix" -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -ParentPolicy ThirdParty -policyName "Citrix" -version "1.0.0.1"

This would create a new policy scanning the folder and making a policy for the ThirdParty policy.

Merge Policy

.\MergePolicy.ps1 -WDACFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -PolicyName ThirdParty

This will merge all the Third Party XMLs and compile the binary.

Create App

.\CreateApp.ps1 -wdacFolder "C:\Users\happysccm\Documents\GitHub\WDAC\" -appVersion "3.0.0.2"

This will copy the binaries to the AppBuild folder and spit out a folder ready to be deployed by SCCM.

Deploy

Create an App in sccm

Use the AppDetection.ps1 it generated, this verifies the hash of all files in the code integrity policies folder, ignoring built in ones, thiscan be altered in the createapp.ps1.

Folder Structure

AppBuild: Appbuild Contains exe's and scripts to create the SCCM app.

Appbuild\Source: Default script to deploy WDAC and make SCCM a managed installer.

Appbuild\Source\Binary: Compiled policies are moved here.

Appbuild\Builds: Script will create source files for an SCCM deployment including app detection script.

Policies\Base: Base policy xml goes here. Kind of the default policy you want before customizations

Policies\SOE: All apps that go on every machine

Policies\ThirdParty: Supplemental apps that need to be added.

It's best to deploy it via a script, also enable the managed installer reg for sccm or managed installer just doesn't work

reg.exe add HKLM\SOFTWARE\Microsoft\CCM /v EnableManagedInstaller /t REG_DWORD /d "1" /f

Script lets you pick the iso, mounts it, extracts Enterprise Wim, injects dot net, copies wim to network folder. Then copies the wim path to clipboard

#File Picker
Function Get-FileName($initialDirectory)
{  
 [System.Reflection.Assembly]::LoadWithPartialName(“System.windows.forms”) |
 Out-Null

 $OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
 $OpenFileDialog.initialDirectory = $initialDirectory
 $OpenFileDialog.filter = “Isos| *.iso”
 $OpenFileDialog.ShowDialog() | Out-Null
 $OpenFileDialog.filename
}

# Vars
$date = (Get-Date -UFormat "%d-%b-%Y")
$name = "Windows 11 22H2 Enterprise $date"
$networkFolder =  "\\NetworkPath\Windows 11 22H2\$name"

write-host "Choose Windows 11 ISO"
$iso = Get-FileName -initialDirectory “c:\users\connor\downloads”
$isoMount = Mount-DiskImage -ImagePath $iso -NoDriveLetter

#set up dirs
rmdir "$env:TEMP\Images\" -Force -recurse -ErrorAction SilentlyContinue
mkdir "$env:TEMP\Images\" -ErrorAction SilentlyContinue
mkdir "$env:TEMP\Images\mount"  -ErrorAction SilentlyContinue

#Export image
Export-WindowsImage -SourceImagePath "$($isoMount.DevicePath)\sources\install.wim" -SourceIndex 3 -DestinationImagePath "$env:TEMP\Images\install.wim" -DestinationName $name 

#mount new wim
Mount-WindowsImage -ImagePath "$env:TEMP\Images\install.wim" -Index 1 -Path "$env:TEMP\Images\mount"
#add dot net
Enable-WindowsOptionalFeature -Path "$env:TEMP\Images\mount" -FeatureName "NetFx3" -Source "$($isoMount.DevicePath)\sources\sxs\"
#unmount clean up
Dismount-WindowsImage -Path "$env:TEMP\Images\mount" -Save
mkdir "$networkFolder"
Copy-Item "$env:TEMP\Images\install.wim" $networkFolder
Dismount-DiskImage -DevicePath $isoMount.DevicePath
#copy path for CM
Set-clipboard -value "$networkFolder\Install.wim"

Install VDA Step 1 (Important bits bold):
VDAWorkstationSetup_2206.exe /controllers "controller1 controller2 controller3 controller4" /remotepc /quiet /noreboot /noresume /enable_remote_assistance /logpath "C:\Windows\Temp" /enable_hdx_ports /enable_hdx_udp_ports /components vda /includeadditional "Citrix VDA Upgrade Agent"

Options:
Success Codes 0 8 3

Restart Computer:
The currently installed default operating system

Options:
Conditions
_SMSTSLastActionRetCode Not equals 0
_SMSTSLastActionRetCode Not equals 8

Install VDA Step 2:
Command line: %ProgramData%\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe

Options:
Success Codes 0 8 3
Conditions
_SMSTSLastActionName equals 'Restart Computer'

Restart Computer:
The currently installed default operating syste

Options:
Conditions
_SMSTSLastActionRetCode Not equals 0
_SMSTSLastActionRetCode Not equals 8

Install VDA Step 3:
Command line: %ProgramData%\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe

Options:
Success Codes 0 8 3
Conditions
_SMSTSLastActionName equals 'Restart Computer'

Restart Computer:
The currently installed default operating syste

Options:
Conditions
_SMSTSLastActionRetCode Not equals 0
_SMSTSLastActionRetCode Not equals 8

Install VDA Step 4:
Command line: %ProgramData%\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe

Options:
Success Codes 0 8 3
Conditions
_SMSTSLastActionName equals 'Restart Computer'

Restart Computer:
The currently installed default operating syste

Options:
Conditions
_SMSTSLastActionRetCode Not equals 0
_SMSTSLastActionRetCode Not equals 8

Install VDA Step 5:
Command line: %ProgramData%\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe

Options:
Continue on Error
Success Codes 0 8 3
Conditions
_SMSTSLastActionName equals 'Restart Computer'

Restart Computer:
The currently installed default operating syste

Options:

Conditions
_SMSTSLastActionRetCode Not equals 0
_SMSTSLastActionRetCode Not equals 8

Restart computer:
Options:
NA

$GetVM = Get-VM
Foreach ($vm in $GetVM)
{

Write-Host "Removing PXE from $($vm.Name)"
$old_boot_order = Get-VMFirmware -VMName $($vm.Name) | Select-Object -ExpandProperty BootOrder


$new_boot_order = $old_boot_order | Where-Object { $_.BootType -ne "Network" }

Set-VMFirmware -VMName $($vm.Name) -BootOrder $new_boot_order

}