azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-17 14:35:21

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 14:35:21
This commit is contained in:
Howard Enos
2026-07-17 14:35:55 -07:00
parent 8d2ca14cac
commit 5076f8f4b1
10 changed files with 289 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md
View File

@@ -98,3 +98,47 @@ Session ended with app restriction still incomplete. The UI restrictions (no CMD
- Caregiver controls doc: `clients/cascades-tucson/docs/security/hipaa-caregiver-controls.md`
- ALIS SSO app: `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`
- Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15)
## Update: 14:34 PT — AppLocker app restriction completed
### Session Summary
Completed the app restriction for caregivers on NURSESTATION-PC using AppLocker, the built-in GPO-based application control. Howard directed that the solution must use proper domain tools (not hacks like app removal) so that non-caregiver users retain full access and the configuration survives machine replacement.
AppLocker Packaged App Rules were built with an `Allow Everyone: *` baseline (all users get all apps by default) plus 10 Deny rules scoped to `SG-Caregivers` (SID `S-1-5-21-388235164-2207693853-3666415804-1183`) blocking non-essential user-facing apps: Edge GameAssist, Paint, Photos, Store, Wallet, Cortana, Intel Graphics/Experience/Optane, and Realtek Audio. The Executable/MSI/Script/DLL rule collections are set to `NotConfigured` (no restriction on Win32 apps — the existing UI restrictions via the kiosk GPO handle CMD/PowerShell/Settings/Control Panel/Run/Task Manager/Store blocking).
The policy XML was written to `\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml`, applied locally on NURSESTATION-PC via `Set-AppLockerPolicy`, and also written into the `CSC - Caregiver Device Lockdown` GPO (Computer Configuration, `HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx`) with individual rules as registry values. The Application Identity service (`AppIDSvc`) was set to Automatic start both locally and via GPO. Howard confirmed the restrictions are working — blocked apps show the administrator block message for caregivers while non-caregivers are unaffected.
### Key Decisions
- AppLocker chosen over app removal because non-caregiver users need access to all apps and the config must survive machine replacement. AppLocker is the proper GPO-based tool for group-specific app whitelisting.
- Packaged App Rules only (not Executable Rules) — Win32 app access is controlled by the existing UI restrictions (DisableCMD, NoRun, NoControlPanel, etc.) in the kiosk GPO. AppLocker Executable Rules would affect all users on the machine and can't be scoped to a group without complex workarounds.
- `Allow Everyone: *` + `Deny SG-Caregivers: [specific apps]` pattern — the only AppLocker approach that restricts one group while leaving everyone else unrestricted. Deny rules override Allow rules, so caregivers are blocked from the listed apps despite the baseline Allow.
- Most bloatware (Netflix, Xbox, Camera, Spotify, etc.) was already absent from the machine — the deny list focused on what was actually installed.
- Confirmed caregiver accounts are standard domain users (not admin) — no local admin, no Domain Admins membership, only SG-Caregivers group membership.
### Problems Encountered
- RMM agent body-size limit (~7KB encoded) repeatedly hit when building AppLocker XML inline in PowerShell scripts. Resolved by writing the XML generation script to SYSVOL on CS-SERVER first, then applying from NURSESTATION-PC with a simple one-liner referencing the SYSVOL path.
- Initial `Get-AppxPackage -AllUsers -Name $name` returned NOT_INSTALLED for most apps despite earlier full listing showing them — likely a timing issue with package registration state after profile operations. Re-enumerated with a filtered full listing to get accurate installed app inventory.
### Configuration Changes
- `\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml` — NEW: AppLocker policy XML (5282 chars, 11 rules: 1 Allow Everyone + 10 Deny SG-Caregivers)
- GPO `CSC - Caregiver Device Lockdown`: AppLocker Appx rules added (HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx), AppIDSvc Start=2 (Automatic)
- NURSESTATION-PC: AppIDSvc enabled and running, AppLocker local policy applied
- Local scripts created: `applocker-step1-enable.ps1`, `applocker-recheck-apps.ps1`, `applocker-apply-simple.ps1`, `applocker-write-xml.ps1`, `applocker-to-gpo.ps1`, `applocker-stage.ps1`, `build-applocker-policy.ps1`, `get-applocker-sids.ps1`
### Infrastructure
- SG-Caregivers SID: `S-1-5-21-388235164-2207693853-3666415804-1183`
- Domain Users SID: `S-1-5-21-388235164-2207693853-3666415804-513`
- AppLocker policy path: `\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml`
- GPO: `CSC - Caregiver Device Lockdown`, AppLocker rules in `HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx`
### Pending / Incomplete Tasks
1. **ASSISTNURSE-PC:** Move from CN=Computers to OU=Caregiver Devices + deploy machine-level printers + gpupdate. All GPO settings (kiosk Edge policies, shortcuts, AppLocker, UI restrictions, DontDisplayLastUserName) apply automatically via OU membership.
2. **Test as non-caregiver:** Verify Howard's own login is completely unrestricted (no AppLocker blocks, no UI restrictions, full Start menu).
3. **PRT/SSO verification:** Confirm ALIS SSO is fully silent after the PRT cache clear + reboot.
4. **Remaining roadmap items carried forward from earlier session.**