derwowusste
22.12.2021, aktualisiert am 23.07.2023
view23124
view3
9
Goto Top

Applocker auf Win10 oder 11 Home? So geht es!

TippSicherheitSicherheitstools
article-picture
Moin.

Applocker war traditionell den Windowseditionen Enterprise und Education vorbehalten geblieben, nur diese konnten Applocker per GPO aktivieren und managen.

Doch dann sorgte Microsoft mit der neuen Dokumentation https://docs.microsoft.com/en-us/windows/security/threat-protection/wind ... für Verwirrung (zumindest bei mir):

You can use the AppLocker CSP to configure AppLocker policies on any edition of Windows 10 and Windows 11 supported by Mobile Device Management (MDM).

Gut, "wie kommt man an das MDM ran?", ist die nächste Frage. Ich hatte schon geahnt, dass es da eine Möglichkeit für lau gibt, war aber noch nicht darüber gestolpert, bislang, da ich auch kein MDM-Pilot bin.

Eine Microsoft MVP ist so freundlich, das Ganze aufzuklären und hier aufzuzeigen, dass es auch ohne MDM, rein mit Powershell funktioniert. Diese Skripte sollte Ihr Euch gut weglegen, wenn Ihr es mal benötigt: https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/App ...

Vergleicht man das mit dem C't-Projekt "restric'tor" https://www.heise.de/download/product/restrictor welches den Vorgänger von Applocker für alle Editionen bereitstellt, indem es ein Frontend bietet, fällt auf, dass restric'tor zwar weitaus besser aussieht, aber auch entscheidend weniger kann: es kann z.B. nicht den Zugriff auf UWP-("Store")Apps beschränken, was doch eine wichtige Sache ist.

Die verlinkten Skripte sind für .exe-Einschränkungen, nicht für UWP-Apps. Edit: Weiter unten habe ich einen Kommentar mit einem Codebeispiel zum Sperren von Modern Apps (vom MS Store) gegeben.

PS: Der MDM-Ansatz kommt ohne den Dienst "AppIDsvc" (Anwendungsidentität) aus. Somit muss dieser nicht laufen, kann aber auch nicht, um alle Maßnahmen zu deaktivieren, einfach gestoppt werden!
ShareTeilen
Auf Facebook teilen Auf Twitter teilen Auf Reddit teilen Auf Linkedin teilen

Content-ID: 1647775851

Url: https://administrator.de/contentid/1647775851

Ausgedruckt am: 22.11.2024 um 08:11 Uhr

3 Kommentare
Neuester Kommentar
Goto Top
surreal1
surreal1 22.12.2021 um 23:13:59 Uhr
Goto Top
Danke für diesen sehr interessanten Post. Ich war selber schon ziemlich lange auf der Suche, die vollständige Funktion von Applocker auf Pro Versionen nutzen zu können. Dieser Ansatz geht schon Mal in die richtige Richtung.

Leider ist jedoch der Aufwand groß, da GPOs einem sehr viel administrativen Aufwand ersparen, die Fehleranfälligkeit steigt mit selbstangepasste Scripten.

Ist man jedoch auf so eine Funktion angewiesen, lohnt sich der Aufwand, den man mit bestimmten Methoden einfach umgehen kann um eine Menge Geld für Drittanbieter Lösungen zu sparen und den Overhead gering zu halten.
DerWoWusste
DerWoWusste 23.12.2021 um 07:36:50 Uhr
Goto Top
Kann ich nicht nachvollziehen. Du testest Applockerpolicies eh, somit fallen Fehler auf.
Und deployen lässt sich ein Script per GPO. Der Aufwand ist der gleiche, es ist sogar übersichtlicher als die GUI.
DerWoWusste
DerWoWusste 22.06.2022 aktualisiert um 13:08:14 Uhr
Goto Top
Hier ein Codebeispiel, um bestimmte Apps zu blocken (hier die PhotoApp):
<?xml version="1.0" encoding="utf-8" ?>  
<RuleCollection Type="Appx" EnforcementMode="Enabled">   
    <FilePublisherRule Id="dad1b5df-812e-4a4e-8e81-c61eac4f5371" Name="Packaged app: 1527c705-839a-4832-9118-54d4Bd6a0c89 signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="1527c705-839a-4832-9118-54d4Bd6a0c89" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="109dafa6-9453-4f5d-9b87-75769797bf3a" Name="Packaged app: c5e2524a-ea46-4f67-841f-6a9465d9d515 signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="c5e2524a-ea46-4f67-841f-6a9465d9d515" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="5c43a50f-7bf6-4445-a47f-5a87e4ddc942" Name="Packaged app: E2A4F912-2574-4A75-9BB0-0D023378592B signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="E2A4F912-2574-4A75-9BB0-0D023378592B" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="d2cb881b-4fe7-4092-afcf-774e1155f3ce" Name="Packaged app: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="2929cb15-65f9-4f14-9a30-b7be2babdd14" Name="Packaged app: Microsoft.AAD.BrokerPlugin signed by Assigned by your organization" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.AAD.BrokerPlugin" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="a99db914-e602-48f7-8027-9760fd3da522" Name="Packaged app: Microsoft.AccountsControl signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.AccountsControl" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="a1cd8cce-44b0-4bfb-aaeb-2dc9f24bbe6b" Name="Packaged app: Microsoft.AsyncTextService signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.AsyncTextService" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="8253a6c3-66e8-408e-91ee-f20b483153fb" Name="Packaged app: Microsoft.BioEnrollment signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.BioEnrollment" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="8bff1855-045f-4b70-81d7-f50500766450" Name="Packaged app: Microsoft.CredDialogHost signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.CredDialogHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="b46280ec-f984-4886-8fd7-91e1a8e0768c" Name="Packaged app: Microsoft.ECApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.ECApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f0fabc78-27bc-449e-90da-3730a9167649" Name="Packaged app: Microsoft.LockApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.LockApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="508789c8-eb6a-4ea2-bc2c-161ba2f8abf0" Name="Packaged app: Microsoft.MicrosoftEdgeDevToolsClient signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MicrosoftEdgeDevToolsClient" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="feaa49ea-e965-486e-99bf-dfa0da614c47" Name="Packaged app: Microsoft.MicrosoftEdge signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MicrosoftEdge" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="9593c50c-5408-4f36-a7ca-c604efa356fd" Name="Packaged app: Microsoft.Win32WebViewHost signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Win32WebViewHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="89bf1374-64f1-41d1-8e3a-f1e2d747a649" Name="Packaged app: Microsoft.Windows.Apprep.ChxApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Apprep.ChxApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="07919804-b37d-4e5b-b871-631bf80c98c0" Name="Packaged app: Microsoft.Windows.AssignedAccessLockApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.AssignedAccessLockApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f3cd2086-9009-48a4-9210-640b1978e935" Name="Packaged app: Microsoft.Windows.CallingShellApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.CallingShellApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="59234b0e-1005-4966-8f1d-bf3a56daf4d2" Name="Packaged app: Microsoft.Windows.CapturePicker signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.CapturePicker" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c9d295b8-f558-4a10-a696-2c596eca081a" Name="Packaged app: Microsoft.Windows.CloudExperienceHost signed by Email, phone, or Skype" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.CloudExperienceHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="147b65b4-b17b-4cff-a4d4-7355ce20acdb" Name="Packaged app: Microsoft.Windows.ContentDeliveryManager signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.ContentDeliveryManager" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f72f0da1-f95e-4cf4-b933-9644b89be508" Name="Packaged app: Microsoft.Windows.NarratorQuickStart signed by Microsoft" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.NarratorQuickStart" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="ab33f812-7ca7-45b7-a681-c02ee35e0c49" Name="Packaged app: Microsoft.Windows.OOBENetworkCaptivePortal signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.OOBENetworkCaptivePortal" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="a54dc955-c1d7-4919-8b73-f03eb5ddd4d4" Name="Packaged app: Microsoft.Windows.OOBENetworkConnectionFlow signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.OOBENetworkConnectionFlow" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="18bc0a70-97e8-4d30-9f2d-08e99d30e0fe" Name="Packaged app: Microsoft.Windows.ParentalControls signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.ParentalControls" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="50caf7d3-319b-4a4e-af0e-1708ce5687b2" Name="Packaged app: Microsoft.Windows.PeopleExperienceHost signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.PeopleExperienceHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="1b38492b-1490-44f3-808e-8392942b7947" Name="Packaged app: Microsoft.Windows.PinningConfirmationDialog signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.PinningConfirmationDialog" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="75261be7-3fae-43c9-9add-ad47db2ef61f" Name="Packaged app: Microsoft.Windows.Search signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Search" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="1a63cba4-3f86-450c-9254-1664455d639f" Name="Packaged app: Microsoft.Windows.SecHealthUI signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.SecHealthUI" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="2ab6498b-f40a-4109-a90f-0fc0ec310dca" Name="Packaged app: Microsoft.Windows.SecureAssessmentBrowser signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.SecureAssessmentBrowser" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f7cf2a75-6e26-4ffa-a322-ee14ce756a04" Name="Packaged app: Microsoft.Windows.ShellExperienceHost signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.ShellExperienceHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="7961e7e4-2cb8-4d42-8fc3-85f67c68c953" Name="Packaged app: Microsoft.Windows.StartMenuExperienceHost signed by ms-resource:StartMenuExperienceHost/PublisherDisplayName" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.StartMenuExperienceHost" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="31c410a8-f14f-46dc-ad36-7b89439db085" Name="Packaged app: Microsoft.Windows.XGpuEjectDialog signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.XGpuEjectDialog" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="be8fab0c-2c43-4426-affc-7bcc64962d13" Name="Packaged app: MicrosoftWindows.Client.CBS signed by Microsoft Windows" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="MicrosoftWindows.Client.CBS" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="7a7ba1ef-2392-414d-b0ed-67c74a40405d" Name="Packaged app: MicrosoftWindows.UndockedDevKit signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="MicrosoftWindows.UndockedDevKit" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f78f6168-395e-44d6-9ff2-a159e330767e" Name="Packaged app: NcsiUwpApp signed by Microsoft" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="NcsiUwpApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="faee9c01-53d1-49f1-ae82-7c1628248ce7" Name="Packaged app: Windows.CBSPreview signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Windows.CBSPreview" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="3d4f0fc6-bbd7-4be7-8bfc-49df63a4b019" Name="Packaged app: windows.immersivecontrolpanel signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="windows.immersivecontrolpanel" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="2e1bd860-c657-4e30-a9a0-4153c1580768" Name="Packaged app: Windows.PrintDialog signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Windows.PrintDialog" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="7abb7b6b-9c05-433f-9269-9da5b42abbb8" Name="Packaged app: Microsoft.549981C3F5F10 signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.549981C3F5F10" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="417d5201-b26b-4f59-bb19-3e0350afdb29" Name="Packaged app: Microsoft.DesktopAppInstaller signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.DesktopAppInstaller" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="d1e47991-07a3-4a2e-baea-b41054daddff" Name="Packaged app: Microsoft.GetHelp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.GetHelp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="f63a6b71-2b92-4bf9-8019-5d17e54d5ff6" Name="Packaged app: Microsoft.Getstarted signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Getstarted" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="061d022d-d5bc-4abb-a571-7bbafd1ea825" Name="Packaged app: Microsoft.HEIFImageExtension signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.HEIFImageExtension" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="24e088fd-67c6-4297-bc04-8fc1457f329f" Name="Packaged app: Microsoft.Microsoft3DViewer signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Microsoft3DViewer" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="03329953-855f-4ba2-af8d-f238a2fcfbc7" Name="Packaged app: Microsoft.MicrosoftOfficeHub signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MicrosoftOfficeHub" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="07ac64b3-cb20-4429-8cbd-1f0f4cd9244c" Name="Packaged app: Microsoft.MicrosoftStickyNotes signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MicrosoftStickyNotes" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="83135006-63fe-4bdb-81d3-ee57b6214ae4" Name="Packaged app: Microsoft.MixedReality.Portal signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MixedReality.Portal" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="737bb07d-083c-41f7-8b49-1fc9e29cf4a0" Name="Packaged app: Microsoft.MSPaint signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.MSPaint" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="14fe8c5d-f945-42f2-b0d6-7b4bd59301e6" Name="Packaged app: Microsoft.Office.OneNote signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Office.OneNote" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="2df3fb94-a57d-4631-b110-dce35a5b4b6c" Name="Packaged app: Microsoft.People signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.People" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c638fc48-8aed-4ab6-915c-9378919f81af" Name="Packaged app: Microsoft.ScreenSketch signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.ScreenSketch" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="2a1a5f94-4895-432c-9e70-04e03bce6778" Name="Packaged app: Microsoft.StorePurchaseApp signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.StorePurchaseApp" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="219e4d25-a7b5-47f6-8d45-c37e13fbc9cd" Name="Packaged app: Microsoft.VP9VideoExtensions signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.VP9VideoExtensions" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="e85bc61c-e2e7-4753-b905-ba34796f715c" Name="Packaged app: Microsoft.WebMediaExtensions signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WebMediaExtensions" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="448a26b9-e180-49d6-bd3b-b935f5d389ad" Name="Packaged app: Microsoft.WebpImageExtension signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WebpImageExtension" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="4fb9fab5-7edc-4816-aa5f-5cc2c606339d" Name="Packaged app: Microsoft.Windows.Photos signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Photos" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c3266a6c-6a98-4105-86cf-e9bb0dcf265c" Name="Packaged app: Microsoft.WindowsAlarms signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsAlarms" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="342ed5e3-dc7f-4976-bdf8-0202c4965464" Name="Packaged app: Microsoft.WindowsCalculator signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsCalculator" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="10f6bc87-14c0-4aaa-99e0-9fd39b28cc21" Name="Packaged app: Microsoft.WindowsCamera signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsCamera" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="6dbadb53-ae37-40cc-abeb-4ebf92efd20e" Name="Packaged app: microsoft.windowscommunicationsapps signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="microsoft.windowscommunicationsapps" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c47e90d4-bb17-4cc2-8634-7ead019adb37" Name="Packaged app: Microsoft.WindowsFeedbackHub signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsFeedbackHub" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="c37ae60b-92bc-4b96-8029-03d13c225112" Name="Packaged app: Microsoft.WindowsSoundRecorder signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsSoundRecorder" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="9472849d-3e2b-4ce4-9c45-4549a151b658" Name="Packaged app: Microsoft.WindowsStore signed by Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsStore" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
    <FilePublisherRule Id="3ebc0e91-5951-4469-bb6d-cf81956c7965" Name="All signed packaged apps" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow">  
      <Conditions>
        <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">  
          <BinaryVersionRange LowSection="*" HighSection="*" />  
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
</RuleCollection>
->Dies speichern als c:\applocker\applocker_internal.xml
Als eigentliches Powershell-Skript dann per Systemkonto ausführen:
$namespaceName = "root\cimv2\mdm\dmmap"  
$className = "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03"  
$GroupName = "AppLocker001"  
$parentID = "./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName"  
$policyData = Get-Content c:\applocker\applocker_internal.xml -Raw
Add-Type -AssemblyName System.Web
$pdata = [System.Web.HttpUtility]::HtmlEncode($policyData);
New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=$parentID;InstanceID="StoreApps";EnforcementMode="Enabled";Policy=$pData}
Resultat: alle möglichern Apps sind freigegeben, nur die Windows Photo App ist gesperrt.

Wie kommt man nun an die Pfade/Namen? Nehmt Euch einen Rechner mit Win10 Enterprise (falls man auch testen möchte, sonst reicht auch Win10 Pro), öffnet die Applockerkonfig unterhalb von secpol.msc und erstellt Regeln nach Eurem Geschmack. Dann findet ihr die Pfade unter HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SrpV2 in der Registry.

PS: die genutzten Klassennamen findet man unter https://docs.microsoft.com/en-us/windows/win32/dmwmibridgeprov/mdm-bridg ... (im Suchfeld "Applocker" eingeben).
die 4 wichtigen sind:

MDM_AppLocker_MSI03
MDM_AppLocker_Script03
MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03
MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03
heart1
TippSicherheitSicherheitstools
Mehr von DerWoWussteDerWoWussteExcelstart bringt neuerdings FehlerDerWoWusste - 4 KommentareDerWoWussteWindows Server 2025 und Windows 11 24H2 - Remote Credential Guard erneut defektDerWoWusste - 6 KommentareDerWoWussteWin11 23H2 - Pin to start weg, "move to front" stattdessenDerWoWusste - 8 KommentareDerWoWussteAdobe Reader - Revocationcheck von Signaturen misslingtDerWoWusste - 15 Kommentare
Heiß diskutiert
superfun2k24Sophos SFOS 20 DNAT funktioniert nichtsuperfun2k24 - 26 Kommentareuser217Kaufberatung Hardware - Hyper-V Cluster 3 Nodesuser217 - 25 KommentarePharaunIntel-E810 QSFP28 to Mikrotik QSPF+ mit 40Gbit VerbindungPharaun - 23 KommentareYan2021Nachricht an mehrere PCs im Netzwerk sendenYan2021 - 21 KommentarecseLaufwege erfassen in großer Hallecse - 20 Kommentareprplemk2Testumgebung bauen (Grundlegend)prplemk2 - 19 KommentareaufdemmarsHP Z620 USB hat kein Strom beim Startenaufdemmars - 17 KommentareTJ.Hooker74Dom.Admin-Passwort ändern - Auswirkungen auf EX, HCW, AADCTJ.Hooker74 - 14 KommentaremaisenkaiserSwitch ohne STP ins Netzwerkmaisenkaiser - 13 KommentareJudgelgZertifikate in die Exchange Online GAL hochladenJudgelg - 13 KommentareadmtechEntwicklertagebuch: Release 6.4 - Filteradmtech - 13 KommentareleberkaeseFB7590 ISDN Fax-Funktionleberkaese - 12 Kommentare