# Stage the AppLocker script on the endpoint
$script = @'
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
$evSID = 'S-1-1-0'
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
$denyList = @(
    @{Id='b1a1a1a1-1111-1111-1111-111111111101'; Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111102'; Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111103'; Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111104'; Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111105'; Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111106'; Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111107'; Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111108'; Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111109'; Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
    @{Id='b1a1a1a1-1111-1111-1111-111111111110'; Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
)
$denyRules = ''
foreach ($r in $denyList) {
    $denyRules += "<FilePublisherRule Id=`"$($r.Id)`" Name=`"Deny CG: $($r.Name)`" Description=`"`" UserOrGroupSid=`"$cgSID`" Action=`"Deny`"><Conditions><FilePublisherCondition PublisherName=`"$($r.Pub)`" ProductName=`"$($r.Prod)`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`" /></FilePublisherCondition></Conditions></FilePublisherRule>`n"
}
$xml = "<AppLockerPolicy Version=`"1`"><RuleCollection Type=`"Appx`" EnforcementMode=`"Enabled`"><FilePublisherRule Id=`"a9e18c21-ff8f-43cf-b9fc-db40eed693ba`" Name=`"Allow everyone all packaged apps`" Description=`"`" UserOrGroupSid=`"$evSID`" Action=`"Allow`"><Conditions><FilePublisherCondition PublisherName=`"*`" ProductName=`"*`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`" /></FilePublisherCondition></Conditions></FilePublisherRule>`n$denyRules</RuleCollection><RuleCollection Type=`"Exe`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Msi`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Script`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Dll`" EnforcementMode=`"NotConfigured`" /></AppLockerPolicy>"
$xml | Out-File "C:\ProgramData\ACG\applocker-policy.xml" -Encoding UTF8
Set-AppLockerPolicy -XmlPolicy "C:\ProgramData\ACG\applocker-policy.xml"
Write-Output "AppLocker applied: $($denyList.Count) Deny rules for SG-Caregivers"
$denyList | ForEach-Object { Write-Output "  Denied: $($_.Prod)" }
$v = Get-AppLockerPolicy -Local -Xml
Write-Output "Policy length: $($v.Length) chars"
'@
New-Item -ItemType Directory -Path "C:\ProgramData\ACG" -Force | Out-Null
Set-Content "C:\ProgramData\ACG\apply-applocker.ps1" $script -Force
Write-Output "Staged script at C:\ProgramData\ACG\apply-applocker.ps1"
