Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1011628">New rules with the correction of [USER=32260]@Andy Ful[/USER] (thanks <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />) Allow DLL&#039;s everywhere, but block unsigned executables/iinstalleers and unsigned scripts in user space[SPOILER=&quot;Allow DLL&#039;s everywhere&quot;]&lt;#.SYNOPSIS&nbsp; &nbsp; This function creates new AppLocker settings using MDM WMI Bridge.&nbsp; &nbsp; All previous rules will be deleted..CREDITS&nbsp; &nbsp; The script is based on the script for EXE files made by Sandy Zeng (Sandy Tsang).&nbsp; &nbsp; <a href="https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker" target="_blank">MSIntune/Intune-PowerShell/AppLocker at master · sandytsang/MSIntune</a>#&gt;$namespaceName = &quot;root\cimv2\mdm\dmmap&quot; #Do not change this$GroupName = &quot;AppLocker001&quot; #Your own groupName$parentID = &quot;./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName&quot;$classNameDLL = &quot;MDM_AppLocker_DLL03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;DLL&#039;&quot;&nbsp; | Remove-CimInstance$classNameEXE = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;EXE&#039;&quot;&nbsp; | Remove-CimInstance$classNameMSI = &quot;MDM_AppLocker_MSI03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;MSI&#039;&quot;&nbsp; | Remove-CimInstance$classNameScript = &quot;MDM_AppLocker_Script03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Script&#039;&quot;&nbsp; | Remove-CimInstance$classNameStoreApps = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03&quot;Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Storeapps&#039;&quot;&nbsp; | Remove-CimInstanceAdd-Type -AssemblyName System.Web#This is example Rule Collection for EXE$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Exe&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;921cc481-6e17-4653-8f75-050b80acca20&quot; Name=&quot;All files located in the Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;a61c8b2c-a319-4cd0-9690-d2177cad7b51&quot; Name=&quot;All files located in the Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\packages\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\servicing\sessions\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;9ab086ea-40a8-4b05-875b-f9fdf9962ba8&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID=&quot;EXE&quot;;Policy=$obj}#This is example Rule Collection for MSI$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Msi&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;b7af7102-efde-4369-8a89-7a6a392d1473&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;5b290184-345a-4453-b184-45305f6d9a54&quot; Name=&quot;All files located in the folder %systemdrive%\Windows\Installer.&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\Installer\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;64ad46ff-0d71-4fa0-a30b-3f3d30c5433d&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*.*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID=&quot;MSI&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Script&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;06dce67b-934c-454f-a263-2515c8796a5d&quot; Name=&quot;All scripts in Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;9428c672-5fc3-47f4-808a-a0011f36dd2c&quot; Name=&quot;All scripts in Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;ed97d0cb-15ff-430f-b82c-8d7832957725&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID=&quot;Script&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Dll&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;bac4b0bf-6f1b-40e8-8627-8545fa89c8b6&quot; Name=&quot;Aloow all DLLs everywhere&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID=&quot;DLL&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Appx&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;a9e18c21-ff8f-43cf-b9fc-db40eed693ba&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID=&quot;Storeapps&quot;;Policy=$obj}[/SPOILER]As said my wife&#039;s laptop is using nearly Microsoft only software so I can use MD exploit Protection enabling Code Integrity Guard as an additional layer of protection (allow only Microsoft signed DLL&#039;s) for Microsoft Office, Edge and Explorer.&nbsp; All third-party software is not allowed to start other programs (also restricted by MD&#039;s exploit protection). My wife has a HP laptop which updates fine with Configure Defender on MAX, so I am aware of the holes, but happy with the extra protection Andy-san provides us with Configure Defender and now these AppLocler scripts for Windows 11H2<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="ForgottenSeer 97327, post: 1011628"] New rules with the correction of [USER=32260]@Andy Ful[/USER] (thanks (y)) Allow DLL's everywhere, but block unsigned executables/iinstalleers and unsigned scripts in user space [SPOILER="Allow DLL's everywhere"] <# .SYNOPSIS This function creates new AppLocker settings using MDM WMI Bridge. All previous rules will be deleted. .CREDITS The script is based on the script for EXE files made by Sandy Zeng (Sandy Tsang). [URL='https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker']MSIntune/Intune-PowerShell/AppLocker at master · sandytsang/MSIntune[/URL] #> $namespaceName = "root\cimv2\mdm\dmmap" #Do not change this $GroupName = "AppLocker001" #Your own groupName $parentID = "./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName" $classNameDLL = "MDM_AppLocker_DLL03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter "ParentID=`'$parentID`' and InstanceID='DLL'" | Remove-CimInstance $classNameEXE = "MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter "ParentID=`'$parentID`' and InstanceID='EXE'" | Remove-CimInstance $classNameMSI = "MDM_AppLocker_MSI03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter "ParentID=`'$parentID`' and InstanceID='MSI'" | Remove-CimInstance $classNameScript = "MDM_AppLocker_Script03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter "ParentID=`'$parentID`' and InstanceID='Script'" | Remove-CimInstance $classNameStoreApps = "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03" Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter "ParentID=`'$parentID`' and InstanceID='Storeapps'" | Remove-CimInstance Add-Type -AssemblyName System.Web #This is example Rule Collection for EXE $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="All files located in the Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="All files located in the Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%WINDIR%\servicing\packages\*" /> <FilePathCondition Path="%WINDIR%\servicing\sessions\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <Exceptions> </FilePathRule> <FilePublisherRule Id="9ab086ea-40a8-4b05-875b-f9fdf9962ba8" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID="EXE";Policy=$obj} #This is example Rule Collection for MSI $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePublisherRule Id="b7af7102-efde-4369-8a89-7a6a392d1473" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePathRule Id="5b290184-345a-4453-b184-45305f6d9a54" Name="All files located in the folder %systemdrive%\Windows\Installer." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\Installer\*" /> </Conditions> </FilePathRule> <FilePathRule Id="64ad46ff-0d71-4fa0-a30b-3f3d30c5433d" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*.*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID="MSI";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="06dce67b-934c-454f-a263-2515c8796a5d" Name="All scripts in Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="9428c672-5fc3-47f4-808a-a0011f36dd2c" Name="All scripts in Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="ed97d0cb-15ff-430f-b82c-8d7832957725" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID="Script";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Dll" EnforcementMode="Enabled"> <FilePathRule Id="bac4b0bf-6f1b-40e8-8627-8545fa89c8b6" Name="Aloow all DLLs everywhere" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID="DLL";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID="Storeapps";Policy=$obj} [/SPOILER] As said my wife's laptop is using nearly Microsoft only software so I can use MD exploit Protection enabling Code Integrity Guard as an additional layer of protection (allow only Microsoft signed DLL's) for Microsoft Office, Edge and Explorer. All third-party software is not allowed to start other programs (also restricted by MD's exploit protection). My wife has a HP laptop which updates fine with Configure Defender on MAX, so I am aware of the holes, but happy with the extra protection Andy-san provides us with Configure Defender and now these AppLocler scripts for Windows 11H2 (y) (y) (y) [/QUOTE]

Verification