Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1011641" data-attributes="member: 32260">Hard_Configurator on Recommended_Settings does not require HomeAppLocker scripts. One can use modified scripts for Windows_10_Basic_Recommended_Settings, for example:[CODE]&lt;#.SYNOPSIS&nbsp; &nbsp; This function creates new AppLocker settings for SimpleWindowsHardening using MDM WMI Bridge.&nbsp; &nbsp; All previous rules will be deleted..CREDITS&nbsp; &nbsp; These scripts are based on the script for EXE files made by Sandy Zeng (Sandy Tsang).&nbsp; &nbsp; https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker#&gt;$namespaceName = &quot;root\cimv2\mdm\dmmap&quot; #Do not change this$GroupName = &quot;AppLocker001&quot; #Your own groupName$parentID = &quot;./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName&quot;$classNameDLL = &quot;MDM_AppLocker_DLL03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;DLL&#039;&quot;&nbsp; | Remove-CimInstance$classNameEXE = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;EXE&#039;&quot;&nbsp; | Remove-CimInstance$classNameMSI = &quot;MDM_AppLocker_MSI03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;MSI&#039;&quot;&nbsp; | Remove-CimInstance$classNameScript = &quot;MDM_AppLocker_Script03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Script&#039;&quot;&nbsp; | Remove-CimInstance$classNameStoreApps = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03&quot;Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Storeapps&#039;&quot;&nbsp; | Remove-CimInstanceAdd-Type -AssemblyName System.Web#This is example Rule Collection for EXE$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Exe&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;921cc481-6e17-4653-8f75-050b80acca20&quot; Name=&quot;All files in the Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;a61c8b2c-a319-4cd0-9690-d2177cad7b51&quot; Name=&quot;All files in the Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;9ab086ea-40a8-4b05-875b-f9fdf9962ba8&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID=&quot;EXE&quot;;Policy=$obj}#This is example Rule Collection for MSI$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Msi&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;b7af7102-efde-4369-8a89-7a6a392d1473&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;5b290184-345a-4453-b184-45305f6d9a54&quot; Name=&quot;All files in the folder %systemdrive%\Windows\Installer.&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\Installer\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;64ad46ff-0d71-4fa0-a30b-3f3d30c5433d&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*.*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID=&quot;MSI&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Dll&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;bac4b0bf-6f1b-40e8-8627-8545fa89c8b6&quot; Name=&quot;All DLLs in Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;3737732c-99b7-41d4-9037-9cddfb0de0d0&quot; Name=&quot;All DLLs in Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;1f0d0ec5-8523-4aa0-976a-ad2d2c21eed7&quot; Name=&quot;All Signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID=&quot;DLL&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Appx&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;a9e18c21-ff8f-43cf-b9fc-db40eed693ba&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID=&quot;Storeapps&quot;;Policy=$obj}[/CODE]The above script is similar to the previous one, but the Script section is deleted (H_C settings provide better script protection).The script that removes restrictions is like in my previous post.Warning!!!I strongly recommend making a System Restore Point before applying the Applocker rules.Post updated.</blockquote>

[QUOTE="Andy Ful, post: 1011641, member: 32260"] Hard_Configurator on Recommended_Settings does not require HomeAppLocker scripts. One can use modified scripts for Windows_10_Basic_Recommended_Settings, for example: [CODE]<# .SYNOPSIS This function creates new AppLocker settings for SimpleWindowsHardening using MDM WMI Bridge. All previous rules will be deleted. .CREDITS These scripts are based on the script for EXE files made by Sandy Zeng (Sandy Tsang). https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker #> $namespaceName = "root\cimv2\mdm\dmmap" #Do not change this $GroupName = "AppLocker001" #Your own groupName $parentID = "./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName" $classNameDLL = "MDM_AppLocker_DLL03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter "ParentID=`'$parentID`' and InstanceID='DLL'" | Remove-CimInstance $classNameEXE = "MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter "ParentID=`'$parentID`' and InstanceID='EXE'" | Remove-CimInstance $classNameMSI = "MDM_AppLocker_MSI03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter "ParentID=`'$parentID`' and InstanceID='MSI'" | Remove-CimInstance $classNameScript = "MDM_AppLocker_Script03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter "ParentID=`'$parentID`' and InstanceID='Script'" | Remove-CimInstance $classNameStoreApps = "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03" Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter "ParentID=`'$parentID`' and InstanceID='Storeapps'" | Remove-CimInstance Add-Type -AssemblyName System.Web #This is example Rule Collection for EXE $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="All files in the Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="All files in the Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePublisherRule Id="9ab086ea-40a8-4b05-875b-f9fdf9962ba8" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID="EXE";Policy=$obj} #This is example Rule Collection for MSI $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePublisherRule Id="b7af7102-efde-4369-8a89-7a6a392d1473" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePathRule Id="5b290184-345a-4453-b184-45305f6d9a54" Name="All files in the folder %systemdrive%\Windows\Installer." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\Installer\*" /> </Conditions> </FilePathRule> <FilePathRule Id="64ad46ff-0d71-4fa0-a30b-3f3d30c5433d" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*.*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID="MSI";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Dll" EnforcementMode="Enabled"> <FilePathRule Id="bac4b0bf-6f1b-40e8-8627-8545fa89c8b6" Name="All DLLs in Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="3737732c-99b7-41d4-9037-9cddfb0de0d0" Name="All DLLs in Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePublisherRule Id="1f0d0ec5-8523-4aa0-976a-ad2d2c21eed7" Name="All Signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID="DLL";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID="Storeapps";Policy=$obj} [/CODE] The above script is similar to the previous one, but the Script section is deleted (H_C settings provide better script protection). The script that removes restrictions is like in my previous post. [B][COLOR=rgb(184, 49, 47)]Warning!!! I strongly recommend making a System Restore Point before applying the Applocker rules.[/COLOR] Post updated.[/B] [/QUOTE]

Verification