52 lines
4.5 KiB
PowerShell
52 lines
4.5 KiB
PowerShell
# Build and apply AppLocker policy via the Caregiver Device Lockdown GPO
|
|
# Packaged App Rules: Allow Everyone *, Deny SG-Caregivers specific apps
|
|
# Executable Rules: default 3 rules (Everyone: Windows, ProgramFiles; Admins: *)
|
|
|
|
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
|
$evSID = 'S-1-1-0'
|
|
$adSID = 'S-1-5-32-544'
|
|
|
|
# Apps to DENY for caregivers (user-facing, non-essential)
|
|
$denyApps = @(
|
|
@{Name='Netflix'; Publisher='CN=A278AB0D-5F3F-4AE5-8CFE-4F81D2D0B2CB'},
|
|
@{Name='Microsoft.WindowsCamera'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.GamingApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.XboxApp'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.XboxGameOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.XboxGamingOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Xbox.TCUI'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.XboxIdentityProvider'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.XboxSpeechToTextOverlay'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.ZuneVideo'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.WindowsMaps'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.YourPhone'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.SkypeApp'; Publisher='CN=Skype Software Sarl, O=Microsoft Corporation, L=Luxembourg, S=Luxembourg, C=LU'},
|
|
@{Name='Microsoft.People'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Messaging'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.MixedReality.Portal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Microsoft3DViewer'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Copilot'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.WindowsTerminal'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Edge.GameAssist'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Getstarted'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.OneConnect'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Windows.Photos'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.MSPaint'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'},
|
|
@{Name='Microsoft.Print3D'; Publisher='CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'}
|
|
)
|
|
|
|
# Also deny third-party bloatware
|
|
$denyApps += @(
|
|
@{Name='SpotifyAB.SpotifyMusic'; Publisher='CN=453637B3-4178-46BE-A0F0-B84B10FAF303'},
|
|
@{Name='Evernote.Evernote'; Publisher='CN=3F73DFD8-A32C-4D31-B9D8-9A5B42E1280D'},
|
|
@{Name='C27EB4BA.DropboxOEM'; Publisher='CN=C27EB4BA-869B-4AD4-9872-5B562A3C3E11'},
|
|
@{Name='7EE7776C.LinkedInforWindows'; Publisher='CN=7EE7776C-F189-4999-B4A0-0D96A4B4DC3E'},
|
|
@{Name='AcerIncorporated.AcerCareCenterS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
|
|
@{Name='AcerIncorporated.AcerCollectionS'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'},
|
|
@{Name='AcerIncorporated.AcerRegistration'; Publisher='CN=Acer Incorporated, O=Acer Incorporated, L=Taipei, C=TW'}
|
|
)
|
|
|
|
Write-Output "Building AppLocker policy with $($denyApps.Count) Deny rules for SG-Caregivers..."
|
|
Write-Output "Deny list:"
|
|
$denyApps | ForEach-Object { Write-Output " $($_.Name)" }
|