$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
$evSID = 'S-1-1-0'
$adSID = 'S-1-5-32-544'
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'

# Build deny rules XML fragments for SG-Caregivers
$denyList = @(
    @{Id=[guid]::NewGuid(); Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
    @{Id=[guid]::NewGuid(); Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
    @{Id=[guid]::NewGuid(); Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
    @{Id=[guid]::NewGuid(); Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
    @{Id=[guid]::NewGuid(); Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
    @{Id=[guid]::NewGuid(); Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
    @{Id=[guid]::NewGuid(); Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
    @{Id=[guid]::NewGuid(); Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
    @{Id=[guid]::NewGuid(); Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
    @{Id=[guid]::NewGuid(); Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
)

$denyRules = ''
foreach ($r in $denyList) {
    $denyRules += @"
    <FilePublisherRule Id="$($r.Id)" Name="Deny CG: $($r.Name)" Description="Block for caregivers" UserOrGroupSid="$cgSID" Action="Deny">
      <Conditions>
        <FilePublisherCondition PublisherName="$($r.Pub)" ProductName="$($r.Prod)" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
"@
}

$xml = @"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Appx" EnforcementMode="Enabled">
    <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="Allow everyone all packaged apps" Description="Default" UserOrGroupSid="$evSID" Action="Allow">
      <Conditions>
        <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
          <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
$denyRules
  </RuleCollection>
  <RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
  <RuleCollection Type="Msi" EnforcementMode="NotConfigured" />
  <RuleCollection Type="Script" EnforcementMode="NotConfigured" />
  <RuleCollection Type="Dll" EnforcementMode="NotConfigured" />
</AppLockerPolicy>
"@

# Save and apply
$xml | Out-File "C:\Windows\Temp\applocker-policy.xml" -Encoding UTF8
Set-AppLockerPolicy -XmlPolicy "C:\Windows\Temp\applocker-policy.xml"
Write-Output "AppLocker policy applied with $($denyList.Count) Deny rules for SG-Caregivers"
Write-Output "Denied apps:"
$denyList | ForEach-Object { Write-Output "  $($_.Name) ($($_.Prod))" }
# Verify
$current = Get-AppLockerPolicy -Local -Xml
Write-Output ""
Write-Output "Policy verified: $($current.Length) chars"