# Build and apply AppLocker policy via the Caregiver Device Lockdown GPO
# Packaged App Rules: Allow Everyone *, Deny SG-Caregivers specific apps
# Executable Rules: default 3 rules (Everyone: Windows, ProgramFiles; Admins: *)

$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
$evSID = 'S-1-1-0'
$adSID = 'S-1-5-32-544'

# Apps to DENY for caregivers (user-facing, non-essential)
$denyApps = @(
    @{Name='Netflix'; Publisher='CN=A278AB0D-5F3F-4AE5-8CFE-4F81D2D0B2CB'},
    @{Name='Microsoft.WindowsCamera'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.GamingApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.XboxApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.XboxGameOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.XboxGamingOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Xbox.TCUI'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.XboxIdentityProvider'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.XboxSpeechToTextOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.ZuneVideo'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.WindowsMaps'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.YourPhone'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.SkypeApp'; Publisher='CN=Skype Software Sarl, O=Microsoft Corporation, L=Luxembourg, S=Luxembourg, C=LU'},
    @{Name='Microsoft.People'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Messaging'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.MixedReality.Portal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Microsoft3DViewer'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Copilot'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.WindowsTerminal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Edge.GameAssist'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Getstarted'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.OneConnect'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Windows.Photos'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.MSPaint'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
    @{Name='Microsoft.Print3D'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'}
)

# Also deny third-party bloatware
$denyApps += @(
    @{Name='SpotifyAB.SpotifyMusic'; Publisher='CN=453637B3-4178-46BE-A0F0-B84B10FAF303'},
    @{Name='Evernote.Evernote'; Publisher='CN=3F73DFD8-A32C-4D31-B9D8-9A5B42E1280D'},
    @{Name='C27EB4BA.DropboxOEM'; Publisher='CN=C27EB4BA-869B-4AD4-9872-5B562A3C3E11'},
    @{Name='7EE7776C.LinkedInforWindows'; Publisher='CN=7EE7776C-F189-4999-B4A0-0D96A4B4DC3E'},
    @{Name='AcerIncorporated.AcerCareCenterS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
    @{Name='AcerIncorporated.AcerCollectionS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
    @{Name='AcerIncorporated.AcerRegistration'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'}
)

Write-Output "Building AppLocker policy with $($denyApps.Count) Deny rules for SG-Caregivers..."
Write-Output "Deny list:"
$denyApps | ForEach-Object { Write-Output "  $($_.Name)" }
