63 lines
3.2 KiB
PowerShell
63 lines
3.2 KiB
PowerShell
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
|
$evSID = 'S-1-1-0'
|
|
$adSID = 'S-1-5-32-544'
|
|
$msPub = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
|
$mwPub = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
|
|
|
# Build deny rules XML fragments for SG-Caregivers
|
|
$denyList = @(
|
|
@{Id=[guid]::NewGuid(); Name='Edge GameAssist'; Pub=$msPub; Prod='Microsoft.Edge.GameAssist'},
|
|
@{Id=[guid]::NewGuid(); Name='Paint'; Pub=$msPub; Prod='Microsoft.MSPaint'},
|
|
@{Id=[guid]::NewGuid(); Name='Photos'; Pub=$msPub; Prod='Microsoft.Windows.Photos'},
|
|
@{Id=[guid]::NewGuid(); Name='Store'; Pub=$msPub; Prod='Microsoft.WindowsStore'},
|
|
@{Id=[guid]::NewGuid(); Name='Wallet'; Pub=$msPub; Prod='Microsoft.Wallet'},
|
|
@{Id=[guid]::NewGuid(); Name='Cortana'; Pub=$mwPub; Prod='Microsoft.Windows.Cortana'},
|
|
@{Id=[guid]::NewGuid(); Name='Intel Graphics'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsControlPanel'},
|
|
@{Id=[guid]::NewGuid(); Name='Intel GFX Exp'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelGraphicsExperience'},
|
|
@{Id=[guid]::NewGuid(); Name='Intel Optane'; Pub='CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3'; Prod='AppUp.IntelOptaneMemoryandStorageManagement'},
|
|
@{Id=[guid]::NewGuid(); Name='Realtek Audio'; Pub='CN=83564403-0B26-46B8-9D84-040F43691D31'; Prod='RealtekSemiconductorCorp.RealtekAudioControl'}
|
|
)
|
|
|
|
$denyRules = ''
|
|
foreach ($r in $denyList) {
|
|
$denyRules += @"
|
|
<FilePublisherRule Id="$($r.Id)" Name="Deny CG: $($r.Name)" Description="Block for caregivers" UserOrGroupSid="$cgSID" Action="Deny">
|
|
<Conditions>
|
|
<FilePublisherCondition PublisherName="$($r.Pub)" ProductName="$($r.Prod)" BinaryName="*">
|
|
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
|
|
</FilePublisherCondition>
|
|
</Conditions>
|
|
</FilePublisherRule>
|
|
"@
|
|
}
|
|
|
|
$xml = @"
|
|
<AppLockerPolicy Version="1">
|
|
<RuleCollection Type="Appx" EnforcementMode="Enabled">
|
|
<FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="Allow everyone all packaged apps" Description="Default" UserOrGroupSid="$evSID" Action="Allow">
|
|
<Conditions>
|
|
<FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
|
|
<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
|
|
</FilePublisherCondition>
|
|
</Conditions>
|
|
</FilePublisherRule>
|
|
$denyRules
|
|
</RuleCollection>
|
|
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
|
<RuleCollection Type="Msi" EnforcementMode="NotConfigured" />
|
|
<RuleCollection Type="Script" EnforcementMode="NotConfigured" />
|
|
<RuleCollection Type="Dll" EnforcementMode="NotConfigured" />
|
|
</AppLockerPolicy>
|
|
"@
|
|
|
|
# Save and apply
|
|
$xml | Out-File "C:\Windows\Temp\applocker-policy.xml" -Encoding UTF8
|
|
Set-AppLockerPolicy -XmlPolicy "C:\Windows\Temp\applocker-policy.xml"
|
|
Write-Output "AppLocker policy applied with $($denyList.Count) Deny rules for SG-Caregivers"
|
|
Write-Output "Denied apps:"
|
|
$denyList | ForEach-Object { Write-Output " $($_.Name) ($($_.Prod))" }
|
|
# Verify
|
|
$current = Get-AppLockerPolicy -Local -Xml
|
|
Write-Output ""
|
|
Write-Output "Policy verified: $($current.Length) chars"
|