sync: auto-sync from HOWARD-HOME at 2026-07-17 14:35:21
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-17 14:35:21
This commit is contained in:
@@ -0,0 +1,6 @@
|
||||
Set-Service AppIDSvc -StartupType Automatic
|
||||
Start-Service AppIDSvc -ErrorAction SilentlyContinue
|
||||
Set-AppLockerPolicy -XmlPolicy "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
|
||||
Write-Output "AppIDSvc: $((Get-Service AppIDSvc).Status)"
|
||||
$p = Get-AppLockerPolicy -Local -Xml
|
||||
Write-Output "Policy applied: $($p.Length) chars"
|
||||
62
clients/cascades-tucson/scripts/applocker-apply.ps1
Normal file
62
clients/cascades-tucson/scripts/applocker-apply.ps1
Normal file
@@ -0,0 +1,62 @@
|
||||
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
||||
$evSID = 'S-1-1-0'
|
||||
$adSID = 'S-1-5-32-544'
|
||||
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
|
||||
# Build deny rules XML fragments for SG-Caregivers
|
||||
$denyList = @(
|
||||
@{Id=[guid]::NewGuid(); Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
|
||||
@{Id=[guid]::NewGuid(); Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
|
||||
@{Id=[guid]::NewGuid(); Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
|
||||
@{Id=[guid]::NewGuid(); Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
|
||||
@{Id=[guid]::NewGuid(); Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
|
||||
@{Id=[guid]::NewGuid(); Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
|
||||
@{Id=[guid]::NewGuid(); Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
|
||||
@{Id=[guid]::NewGuid(); Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
|
||||
@{Id=[guid]::NewGuid(); Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
|
||||
@{Id=[guid]::NewGuid(); Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
|
||||
)
|
||||
|
||||
$denyRules = ''
|
||||
foreach ($r in $denyList) {
|
||||
$denyRules += @"
|
||||
<FilePublisherRule Id="$($r.Id)" Name="Deny CG: $($r.Name)" Description="Block for caregivers" UserOrGroupSid="$cgSID" Action="Deny">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="$($r.Pub)" ProductName="$($r.Prod)" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
"@
|
||||
}
|
||||
|
||||
$xml = @"
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection Type="Appx" EnforcementMode="Enabled">
|
||||
<FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="Allow everyone all packaged apps" Description="Default" UserOrGroupSid="$evSID" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
$denyRules
|
||||
</RuleCollection>
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type="Msi" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type="Script" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type="Dll" EnforcementMode="NotConfigured" />
|
||||
</AppLockerPolicy>
|
||||
"@
|
||||
|
||||
# Save and apply
|
||||
$xml | Out-File "C:\Windows\Temp\applocker-policy.xml" -Encoding UTF8
|
||||
Set-AppLockerPolicy -XmlPolicy "C:\Windows\Temp\applocker-policy.xml"
|
||||
Write-Output "AppLocker policy applied with $($denyList.Count) Deny rules for SG-Caregivers"
|
||||
Write-Output "Denied apps:"
|
||||
$denyList | ForEach-Object { Write-Output " $($_.Name) ($($_.Prod))" }
|
||||
# Verify
|
||||
$current = Get-AppLockerPolicy -Local -Xml
|
||||
Write-Output ""
|
||||
Write-Output "Policy verified: $($current.Length) chars"
|
||||
@@ -0,0 +1,9 @@
|
||||
# Check what user-facing apps are actually available
|
||||
$all = Get-AppxPackage -AllUsers -ErrorAction SilentlyContinue
|
||||
$userFacing = $all | Where-Object { $_.Name -notmatch '^Microsoft\.(NET|VCLibs|UI\.Xaml|WindowsApp|Services|Advertising|Office\.(Actions|Push)|AAD|Account|Bio|Cred|Lock|Win32|WidgetsPlatform|AsyncText|ApplicationCompat|AIFabric|DesktopApp|StorePurchase|SecHealth|ECApp|HE[IV]|AV1|AVC|MPEG|Raw|VP9|Webp|Web[Mm]|M365|OneDrive|StartExp|MicrosoftEdge[^.]|Window\.CBS)' -and $_.Name -notmatch '^(Microsoft)?Windows\.' -and $_.Name -notmatch '^(aimgr|InputApp|NcsiUwpApp|MicrosoftWindows\.|MicrosoftCorporationII|KONICAMINOLTA|Windows\.)' -and $_.Name -notmatch '^[0-9a-f]{8}-' -and $_.Name -notmatch '^(E2A4F912|F46D4000|1527c705|c5e2524a)' -and $_.IsFramework -ne $true }
|
||||
Write-Output "=== User-facing apps on this machine ==="
|
||||
$userFacing | Sort-Object Name -Unique | ForEach-Object {
|
||||
Write-Output "$($_.Name) | $($_.Publisher) | $($_.PackageFamilyName)"
|
||||
}
|
||||
Write-Output ""
|
||||
Write-Output "Count: $($userFacing | Sort-Object Name -Unique | Measure-Object | Select-Object -ExpandProperty Count)"
|
||||
33
clients/cascades-tucson/scripts/applocker-stage.ps1
Normal file
33
clients/cascades-tucson/scripts/applocker-stage.ps1
Normal file
@@ -0,0 +1,33 @@
|
||||
# Stage the AppLocker script on the endpoint
|
||||
$script = @'
|
||||
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
||||
$evSID = 'S-1-1-0'
|
||||
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
$denyList = @(
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111101'; Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111102'; Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111103'; Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111104'; Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111105'; Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111106'; Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111107'; Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111108'; Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111109'; Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
|
||||
@{Id='b1a1a1a1-1111-1111-1111-111111111110'; Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
|
||||
)
|
||||
$denyRules = ''
|
||||
foreach ($r in $denyList) {
|
||||
$denyRules += "<FilePublisherRule Id=`"$($r.Id)`" Name=`"Deny CG: $($r.Name)`" Description=`"`" UserOrGroupSid=`"$cgSID`" Action=`"Deny`"><Conditions><FilePublisherCondition PublisherName=`"$($r.Pub)`" ProductName=`"$($r.Prod)`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`" /></FilePublisherCondition></Conditions></FilePublisherRule>`n"
|
||||
}
|
||||
$xml = "<AppLockerPolicy Version=`"1`"><RuleCollection Type=`"Appx`" EnforcementMode=`"Enabled`"><FilePublisherRule Id=`"a9e18c21-ff8f-43cf-b9fc-db40eed693ba`" Name=`"Allow everyone all packaged apps`" Description=`"`" UserOrGroupSid=`"$evSID`" Action=`"Allow`"><Conditions><FilePublisherCondition PublisherName=`"*`" ProductName=`"*`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`" /></FilePublisherCondition></Conditions></FilePublisherRule>`n$denyRules</RuleCollection><RuleCollection Type=`"Exe`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Msi`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Script`" EnforcementMode=`"NotConfigured`" /><RuleCollection Type=`"Dll`" EnforcementMode=`"NotConfigured`" /></AppLockerPolicy>"
|
||||
$xml | Out-File "C:\ProgramData\ACG\applocker-policy.xml" -Encoding UTF8
|
||||
Set-AppLockerPolicy -XmlPolicy "C:\ProgramData\ACG\applocker-policy.xml"
|
||||
Write-Output "AppLocker applied: $($denyList.Count) Deny rules for SG-Caregivers"
|
||||
$denyList | ForEach-Object { Write-Output " Denied: $($_.Prod)" }
|
||||
$v = Get-AppLockerPolicy -Local -Xml
|
||||
Write-Output "Policy length: $($v.Length) chars"
|
||||
'@
|
||||
New-Item -ItemType Directory -Path "C:\ProgramData\ACG" -Force | Out-Null
|
||||
Set-Content "C:\ProgramData\ACG\apply-applocker.ps1" $script -Force
|
||||
Write-Output "Staged script at C:\ProgramData\ACG\apply-applocker.ps1"
|
||||
28
clients/cascades-tucson/scripts/applocker-step1-enable.ps1
Normal file
28
clients/cascades-tucson/scripts/applocker-step1-enable.ps1
Normal file
@@ -0,0 +1,28 @@
|
||||
# Step 1: Enable the Application Identity service (required for AppLocker)
|
||||
Set-Service -Name AppIDSvc -StartupType Automatic
|
||||
Start-Service -Name AppIDSvc -ErrorAction SilentlyContinue
|
||||
$svc = Get-Service AppIDSvc
|
||||
Write-Output "AppIDSvc: Status=$($svc.Status) StartType=$($svc.StartType)"
|
||||
|
||||
# Get publisher info for apps we want to deny
|
||||
$deny = @('4DF9E0F8.Netflix','Microsoft.WindowsCamera','Microsoft.GamingApp','Microsoft.XboxApp',
|
||||
'Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.Xbox.TCUI',
|
||||
'Microsoft.XboxIdentityProvider','Microsoft.XboxSpeechToTextOverlay','Microsoft.ZuneVideo',
|
||||
'Microsoft.WindowsMaps','Microsoft.YourPhone','Microsoft.SkypeApp','Microsoft.People',
|
||||
'Microsoft.Messaging','Microsoft.MixedReality.Portal','Microsoft.Microsoft3DViewer',
|
||||
'Microsoft.Copilot','Microsoft.WindowsTerminal','Microsoft.Edge.GameAssist',
|
||||
'Microsoft.Getstarted','Microsoft.OneConnect','Microsoft.Windows.Photos','Microsoft.MSPaint',
|
||||
'Microsoft.Print3D','SpotifyAB.SpotifyMusic','Evernote.Evernote','C27EB4BA.DropboxOEM',
|
||||
'7EE7776C.LinkedInforWindows','AcerIncorporated.AcerCareCenterS',
|
||||
'AcerIncorporated.AcerCollectionS','AcerIncorporated.AcerRegistration')
|
||||
|
||||
Write-Output ""
|
||||
Write-Output "=== Publisher info for deny list ==="
|
||||
foreach ($name in $deny) {
|
||||
$pkg = Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue | Select-Object -First 1
|
||||
if ($pkg) {
|
||||
Write-Output "$name|$($pkg.Publisher)|$($pkg.PackageFamilyName)"
|
||||
} else {
|
||||
Write-Output "$name|NOT_INSTALLED|"
|
||||
}
|
||||
}
|
||||
22
clients/cascades-tucson/scripts/applocker-to-gpo.ps1
Normal file
22
clients/cascades-tucson/scripts/applocker-to-gpo.ps1
Normal file
@@ -0,0 +1,22 @@
|
||||
Import-Module GroupPolicy
|
||||
$gpoName = 'CSC - Caregiver Device Lockdown'
|
||||
$xmlPath = "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
|
||||
$xml = Get-Content $xmlPath -Raw
|
||||
Set-AppLockerPolicy -XmlPolicy $xmlPath -Ldap "LDAP://$(([ADSI]'').distinguishedName)" -ErrorAction SilentlyContinue
|
||||
# AppLocker GPO needs to be set via registry in the GPO
|
||||
# HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx
|
||||
$gpo = Get-GPO -Name $gpoName
|
||||
$base = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx'
|
||||
Set-GPRegistryValue -Guid $gpo.Id -Key $base -ValueName 'EnforcementMode' -Type String -Value '1' | Out-Null
|
||||
# Parse XML to extract individual rules
|
||||
[xml]$doc = $xml
|
||||
$rules = $doc.AppLockerPolicy.RuleCollection | Where-Object { $_.Type -eq 'Appx' }
|
||||
foreach ($rule in $rules.FilePublisherRule) {
|
||||
$ruleXml = $rule.OuterXml
|
||||
Set-GPRegistryValue -Guid $gpo.Id -Key "$base\$($rule.Id)" -ValueName 'Value' -Type String -Value $ruleXml | Out-Null
|
||||
Write-Output "GPO rule: $($rule.Name)"
|
||||
}
|
||||
Write-Output "AppLocker rules written to GPO: $gpoName"
|
||||
# Enable AppIDSvc via GPO
|
||||
Set-GPRegistryValue -Guid $gpo.Id -Key 'HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc' -ValueName 'Start' -Type DWord -Value 2 | Out-Null
|
||||
Write-Output "AppIDSvc set to Automatic in GPO"
|
||||
25
clients/cascades-tucson/scripts/applocker-write-xml.ps1
Normal file
25
clients/cascades-tucson/scripts/applocker-write-xml.ps1
Normal file
@@ -0,0 +1,25 @@
|
||||
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
||||
$evSID = 'S-1-1-0'
|
||||
$ms = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
$mw = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
||||
$deny = @(
|
||||
@('b1a10001','Edge GameAssist',$ms,'Microsoft.Edge.GameAssist'),
|
||||
@('b1a10002','Paint',$ms,'Microsoft.MSPaint'),
|
||||
@('b1a10003','Photos',$ms,'Microsoft.Windows.Photos'),
|
||||
@('b1a10004','Store',$ms,'Microsoft.WindowsStore'),
|
||||
@('b1a10005','Wallet',$ms,'Microsoft.Wallet'),
|
||||
@('b1a10006','Cortana',$mw,'Microsoft.Windows.Cortana'),
|
||||
@('b1a10007','Intel GFX','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelGraphicsControlPanel'),
|
||||
@('b1a10008','Intel GFX2','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelGraphicsExperience'),
|
||||
@('b1a10009','Intel Opt','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelOptaneMemoryandStorageManagement'),
|
||||
@('b1a1000a','Realtek','CN=83564403-0B26-46B8-9D84-040F43691D31','RealtekSemiconductorCorp.RealtekAudioControl')
|
||||
)
|
||||
$r = ''
|
||||
foreach ($d in $deny) {
|
||||
$id = "$($d[0])-0000-0000-0000-000000000000"
|
||||
$r += "<FilePublisherRule Id=`"$id`" Name=`"$($d[1])`" Description=`"`" UserOrGroupSid=`"$cgSID`" Action=`"Deny`"><Conditions><FilePublisherCondition PublisherName=`"$($d[2])`" ProductName=`"$($d[3])`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`"/></FilePublisherCondition></Conditions></FilePublisherRule>"
|
||||
}
|
||||
$xml = "<AppLockerPolicy Version=`"1`"><RuleCollection Type=`"Appx`" EnforcementMode=`"Enabled`"><FilePublisherRule Id=`"a9e18c21-ff8f-43cf-b9fc-db40eed693ba`" Name=`"Allow all`" Description=`"`" UserOrGroupSid=`"$evSID`" Action=`"Allow`"><Conditions><FilePublisherCondition PublisherName=`"*`" ProductName=`"*`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`"/></FilePublisherCondition></Conditions></FilePublisherRule>$r</RuleCollection><RuleCollection Type=`"Exe`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Msi`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Script`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Dll`" EnforcementMode=`"NotConfigured`"/></AppLockerPolicy>"
|
||||
$path = "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
|
||||
$xml | Out-File $path -Encoding UTF8
|
||||
Write-Output "Written: $path ($($xml.Length) chars, $($deny.Count) deny rules)"
|
||||
51
clients/cascades-tucson/scripts/build-applocker-policy.ps1
Normal file
51
clients/cascades-tucson/scripts/build-applocker-policy.ps1
Normal file
@@ -0,0 +1,51 @@
|
||||
# Build and apply AppLocker policy via the Caregiver Device Lockdown GPO
|
||||
# Packaged App Rules: Allow Everyone *, Deny SG-Caregivers specific apps
|
||||
# Executable Rules: default 3 rules (Everyone: Windows, ProgramFiles; Admins: *)
|
||||
|
||||
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
||||
$evSID = 'S-1-1-0'
|
||||
$adSID = 'S-1-5-32-544'
|
||||
|
||||
# Apps to DENY for caregivers (user-facing, non-essential)
|
||||
$denyApps = @(
|
||||
@{Name='Netflix'; Publisher='CN=A278AB0D-5F3F-4AE5-8CFE-4F81D2D0B2CB'},
|
||||
@{Name='Microsoft.WindowsCamera'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.GamingApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.XboxApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.XboxGameOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.XboxGamingOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Xbox.TCUI'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.XboxIdentityProvider'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.XboxSpeechToTextOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.ZuneVideo'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.WindowsMaps'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.YourPhone'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.SkypeApp'; Publisher='CN=Skype Software Sarl, O=Microsoft Corporation, L=Luxembourg, S=Luxembourg, C=LU'},
|
||||
@{Name='Microsoft.People'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Messaging'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.MixedReality.Portal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Microsoft3DViewer'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Copilot'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.WindowsTerminal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Edge.GameAssist'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Getstarted'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.OneConnect'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Windows.Photos'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.MSPaint'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
||||
@{Name='Microsoft.Print3D'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'}
|
||||
)
|
||||
|
||||
# Also deny third-party bloatware
|
||||
$denyApps += @(
|
||||
@{Name='SpotifyAB.SpotifyMusic'; Publisher='CN=453637B3-4178-46BE-A0F0-B84B10FAF303'},
|
||||
@{Name='Evernote.Evernote'; Publisher='CN=3F73DFD8-A32C-4D31-B9D8-9A5B42E1280D'},
|
||||
@{Name='C27EB4BA.DropboxOEM'; Publisher='CN=C27EB4BA-869B-4AD4-9872-5B562A3C3E11'},
|
||||
@{Name='7EE7776C.LinkedInforWindows'; Publisher='CN=7EE7776C-F189-4999-B4A0-0D96A4B4DC3E'},
|
||||
@{Name='AcerIncorporated.AcerCareCenterS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
|
||||
@{Name='AcerIncorporated.AcerCollectionS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
|
||||
@{Name='AcerIncorporated.AcerRegistration'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'}
|
||||
)
|
||||
|
||||
Write-Output "Building AppLocker policy with $($denyApps.Count) Deny rules for SG-Caregivers..."
|
||||
Write-Output "Deny list:"
|
||||
$denyApps | ForEach-Object { Write-Output " $($_.Name)" }
|
||||
9
clients/cascades-tucson/scripts/get-applocker-sids.ps1
Normal file
9
clients/cascades-tucson/scripts/get-applocker-sids.ps1
Normal file
@@ -0,0 +1,9 @@
|
||||
Import-Module ActiveDirectory
|
||||
$cg = Get-ADGroup 'SG-Caregivers'
|
||||
Write-Output "SG-Caregivers SID: $($cg.SID)"
|
||||
$du = Get-ADGroup 'Domain Users'
|
||||
Write-Output "Domain Users SID: $($du.SID)"
|
||||
$ba = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
|
||||
Write-Output "BUILTIN\Administrators SID: $ba"
|
||||
$everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0')
|
||||
Write-Output "Everyone SID: $everyone"
|
||||
Reference in New Issue
Block a user