azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-17 14:35:21

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 14:35:21
This commit is contained in:
Howard Enos
2026-07-17 14:35:55 -07:00
parent 8d2ca14cac
commit 5076f8f4b1
10 changed files with 289 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
clients/cascades-tucson/scripts/applocker-apply.ps1 Normal file
View File

@@ -0,0 +1,62 @@
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
$evSID = 'S-1-1-0'
$adSID = 'S-1-5-32-544'
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
# Build deny rules XML fragments for SG-Caregivers
$denyList = @(
@{Id=[guid]::NewGuid(); Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
@{Id=[guid]::NewGuid(); Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
@{Id=[guid]::NewGuid(); Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
@{Id=[guid]::NewGuid(); Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
@{Id=[guid]::NewGuid(); Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
@{Id=[guid]::NewGuid(); Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
@{Id=[guid]::NewGuid(); Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
@{Id=[guid]::NewGuid(); Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
@{Id=[guid]::NewGuid(); Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
@{Id=[guid]::NewGuid(); Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
)
$denyRules = ''
foreach ($r in $denyList) {
$denyRules += @"
<FilePublisherRule Id="$($r.Id)" Name="Deny CG: $($r.Name)" Description="Block for caregivers" UserOrGroupSid="$cgSID" Action="Deny">
<Conditions>
<FilePublisherCondition PublisherName="$($r.Pub)" ProductName="$($r.Prod)" BinaryName="*">
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
</FilePublisherCondition>
</Conditions>
</FilePublisherRule>
"@
}
$xml = @"
<AppLockerPolicy Version="1">
<RuleCollection Type="Appx" EnforcementMode="Enabled">
<FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="Allow everyone all packaged apps" Description="Default" UserOrGroupSid="$evSID" Action="Allow">
<Conditions>
<FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
</FilePublisherCondition>
</Conditions>
</FilePublisherRule>
$denyRules
</RuleCollection>
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
<RuleCollection Type="Msi" EnforcementMode="NotConfigured" />
<RuleCollection Type="Script" EnforcementMode="NotConfigured" />
<RuleCollection Type="Dll" EnforcementMode="NotConfigured" />
</AppLockerPolicy>
"@
# Save and apply
$xml | Out-File "C:\Windows\Temp\applocker-policy.xml" -Encoding UTF8
Set-AppLockerPolicy -XmlPolicy "C:\Windows\Temp\applocker-policy.xml"
Write-Output "AppLocker policy applied with $($denyList.Count) Deny rules for SG-Caregivers"
Write-Output "Denied apps:"
$denyList | ForEach-Object { Write-Output " $($_.Name) ($($_.Prod))" }
# Verify
$current = Get-AppLockerPolicy -Local -Xml
Write-Output ""
Write-Output "Policy verified: $($current.Length) chars"