23 lines
1.2 KiB
PowerShell
23 lines
1.2 KiB
PowerShell
Import-Module GroupPolicy
|
|
$gpoName = 'CSC - Caregiver Device Lockdown'
|
|
$xmlPath = "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
|
|
$xml = Get-Content $xmlPath -Raw
|
|
Set-AppLockerPolicy -XmlPolicy $xmlPath -Ldap "LDAP://$(([ADSI]'').distinguishedName)" -ErrorAction SilentlyContinue
|
|
# AppLocker GPO needs to be set via registry in the GPO
|
|
# HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx
|
|
$gpo = Get-GPO -Name $gpoName
|
|
$base = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx'
|
|
Set-GPRegistryValue -Guid $gpo.Id -Key $base -ValueName 'EnforcementMode' -Type String -Value '1' | Out-Null
|
|
# Parse XML to extract individual rules
|
|
[xml]$doc = $xml
|
|
$rules = $doc.AppLockerPolicy.RuleCollection | Where-Object { $_.Type -eq 'Appx' }
|
|
foreach ($rule in $rules.FilePublisherRule) {
|
|
$ruleXml = $rule.OuterXml
|
|
Set-GPRegistryValue -Guid $gpo.Id -Key "$base\$($rule.Id)" -ValueName 'Value' -Type String -Value $ruleXml | Out-Null
|
|
Write-Output "GPO rule: $($rule.Name)"
|
|
}
|
|
Write-Output "AppLocker rules written to GPO: $gpoName"
|
|
# Enable AppIDSvc via GPO
|
|
Set-GPRegistryValue -Guid $gpo.Id -Key 'HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc' -ValueName 'Start' -Type DWord -Value 2 | Out-Null
|
|
Write-Output "AppIDSvc set to Automatic in GPO"
|