Import-Module GroupPolicy
$gpoName = 'CSC - Caregiver Device Lockdown'
$xmlPath = "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
$xml = Get-Content $xmlPath -Raw
Set-AppLockerPolicy -XmlPolicy $xmlPath -Ldap "LDAP://$(([ADSI]'').distinguishedName)" -ErrorAction SilentlyContinue
# AppLocker GPO needs to be set via registry in the GPO
# HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx
$gpo = Get-GPO -Name $gpoName
$base = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx'
Set-GPRegistryValue -Guid $gpo.Id -Key $base -ValueName 'EnforcementMode' -Type String -Value '1' | Out-Null
# Parse XML to extract individual rules
[xml]$doc = $xml
$rules = $doc.AppLockerPolicy.RuleCollection | Where-Object { $_.Type -eq 'Appx' }
foreach ($rule in $rules.FilePublisherRule) {
    $ruleXml = $rule.OuterXml
    Set-GPRegistryValue -Guid $gpo.Id -Key "$base\$($rule.Id)" -ValueName 'Value' -Type String -Value $ruleXml | Out-Null
    Write-Output "GPO rule: $($rule.Name)"
}
Write-Output "AppLocker rules written to GPO: $gpoName"
# Enable AppIDSvc via GPO
Set-GPRegistryValue -Guid $gpo.Id -Key 'HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc' -ValueName 'Start' -Type DWord -Value 2 | Out-Null
Write-Output "AppIDSvc set to Automatic in GPO"