Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1011428">[USER=32260]@Andy Ful[/USER]Andy-san <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> Would you have a look at below rules? I want to allow DLL&#039;s everywhere (because this signed app has unsigned DLL&#039;s: <a href="https://albelli-com-photo-books.software.informer.com/" target="_blank">link</a>)[SPOILER=&quot;Adopted code&quot;]&lt;#.SYNOPSIS&nbsp; &nbsp; This function creates new AppLocker settings using MDM WMI Bridge.&nbsp; &nbsp; All previous rules will be deleted..CREDITS&nbsp; &nbsp; The script is based on the script for EXE files made by Sandy Zeng (Sandy Tsang).&nbsp; &nbsp; <a href="https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker" target="_blank">MSIntune/Intune-PowerShell/AppLocker at master · sandytsang/MSIntune</a>#&gt;$namespaceName = &quot;root\cimv2\mdm\dmmap&quot; #Do not change this$GroupName = &quot;AppLocker001&quot; #Your own groupName$parentID = &quot;./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName&quot;$classNameDLL = &quot;MDM_AppLocker_DLL03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;DLL&#039;&quot;&nbsp; | Remove-CimInstance$classNameEXE = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;EXE&#039;&quot;&nbsp; | Remove-CimInstance$classNameMSI = &quot;MDM_AppLocker_MSI03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;MSI&#039;&quot;&nbsp; | Remove-CimInstance$classNameScript = &quot;MDM_AppLocker_Script03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Script&#039;&quot;&nbsp; | Remove-CimInstance$classNameStoreApps = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03&quot;Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Storeapps&#039;&quot;&nbsp; | Remove-CimInstanceAdd-Type -AssemblyName System.Web#This is example Rule Collection for EXE$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Exe&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;921cc481-6e17-4653-8f75-050b80acca20&quot; Name=&quot;All files located in the Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;a61c8b2c-a319-4cd0-9690-d2177cad7b51&quot; Name=&quot;All files located in the Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\packages\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\sessions\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;a61c8b2c-a319-4cd0-9690-d2177cad7b51&quot; Name=&quot;All files located in the Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%OSDRIVE%\ProgramData\Microsoft\Windows Defender\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;9ab086ea-40a8-4b05-875b-f9fdf9962ba8&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID=&quot;EXE&quot;;Policy=$obj}#This is example Rule Collection for MSI$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Msi&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;b7af7102-efde-4369-8a89-7a6a392d1473&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;5b290184-345a-4453-b184-45305f6d9a54&quot; Name=&quot;All files located in the folder %systemdrive%\Windows\Installer.&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\Installer\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;64ad46ff-0d71-4fa0-a30b-3f3d30c5433d&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*.*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID=&quot;MSI&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Script&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;06dce67b-934c-454f-a263-2515c8796a5d&quot; Name=&quot;All scripts in Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;9428c672-5fc3-47f4-808a-a0011f36dd2c&quot; Name=&quot;All scripts in Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\packages\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\sessions\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp;&nbsp; &lt;/Exceptions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;ed97d0cb-15ff-430f-b82c-8d7832957725&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID=&quot;Script&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Dll&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;bac4b0bf-6f1b-40e8-8627-8545fa89c8b6&quot; Name=&quot;All DLLs&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\packages\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\sessions\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp;&nbsp; &lt;/Exceptions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID=&quot;DLL&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Appx&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;a9e18c21-ff8f-43cf-b9fc-db40eed693ba&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID=&quot;Storeapps&quot;;Policy=$obj}[/SPOILER]I use your ConfigureDefender on Windows home versions and always add Code Integrity Exploit protection rules to Microsoft Office and Edge and add additional &quot;block starting programs&quot; MD Exploit protection restriction to third-party programs living in user space (like this photobook application), so I can live with the reduced protection (excluding user space DLL&#039;s)</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1011428"] [USER=32260]@Andy Ful[/USER] Andy-san :) Would you have a look at below rules? I want to allow DLL's everywhere (because this signed app has unsigned DLL's: [URL='https://albelli-com-photo-books.software.informer.com/']link[/URL]) [SPOILER="Adopted code"] <# .SYNOPSIS This function creates new AppLocker settings using MDM WMI Bridge. All previous rules will be deleted. .CREDITS The script is based on the script for EXE files made by Sandy Zeng (Sandy Tsang). [URL='https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker']MSIntune/Intune-PowerShell/AppLocker at master · sandytsang/MSIntune[/URL] #> $namespaceName = "root\cimv2\mdm\dmmap" #Do not change this $GroupName = "AppLocker001" #Your own groupName $parentID = "./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName" $classNameDLL = "MDM_AppLocker_DLL03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter "ParentID=`'$parentID`' and InstanceID='DLL'" | Remove-CimInstance $classNameEXE = "MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter "ParentID=`'$parentID`' and InstanceID='EXE'" | Remove-CimInstance $classNameMSI = "MDM_AppLocker_MSI03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter "ParentID=`'$parentID`' and InstanceID='MSI'" | Remove-CimInstance $classNameScript = "MDM_AppLocker_Script03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter "ParentID=`'$parentID`' and InstanceID='Script'" | Remove-CimInstance $classNameStoreApps = "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03" Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter "ParentID=`'$parentID`' and InstanceID='Storeapps'" | Remove-CimInstance Add-Type -AssemblyName System.Web #This is example Rule Collection for EXE $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="All files located in the Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="All files located in the Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%WINDIR%\servicing\packages\*" /> <FilePathCondition Path="%WINDIR%\servicing\sessions\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <Exceptions> <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="All files located in the Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%OSDRIVE%\ProgramData\Microsoft\Windows Defender\*" /> </Conditions> </FilePathRule> <FilePublisherRule Id="9ab086ea-40a8-4b05-875b-f9fdf9962ba8" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID="EXE";Policy=$obj} #This is example Rule Collection for MSI $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePublisherRule Id="b7af7102-efde-4369-8a89-7a6a392d1473" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePathRule Id="5b290184-345a-4453-b184-45305f6d9a54" Name="All files located in the folder %systemdrive%\Windows\Installer." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\Installer\*" /> </Conditions> </FilePathRule> <FilePathRule Id="64ad46ff-0d71-4fa0-a30b-3f3d30c5433d" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*.*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID="MSI";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="06dce67b-934c-454f-a263-2515c8796a5d" Name="All scripts in Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="9428c672-5fc3-47f4-808a-a0011f36dd2c" Name="All scripts in Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%WINDIR%\servicing\packages\*" /> <FilePathCondition Path="%WINDIR%\servicing\sessions\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="ed97d0cb-15ff-430f-b82c-8d7832957725" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID="Script";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Dll" EnforcementMode="Enabled"> <FilePathRule Id="bac4b0bf-6f1b-40e8-8627-8545fa89c8b6" Name="All DLLs" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%WINDIR%\servicing\packages\*" /> <FilePathCondition Path="%WINDIR%\servicing\sessions\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> </Exceptions> </FilePathRule> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID="DLL";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID="Storeapps";Policy=$obj} [/SPOILER] I use your ConfigureDefender on Windows home versions and always add Code Integrity Exploit protection rules to Microsoft Office and Edge and add additional "block starting programs" MD Exploit protection restriction to third-party programs living in user space (like this photobook application), so I can live with the reduced protection (excluding user space DLL's) [/QUOTE]

Verification