Jeremy Moskowitz, Group Policy MVP Chief Propeller-Head: GPanswers.com Founder: PolicyPak Software (policypak.com) SESSION CODE: WCL303 Get AppLocker File Info (for.EXEs) : Get-AppLockerFileInformation -Directory 'C:\Program Files' recurse -FileType exe Create AppLocker Policy XML rule set: (Get-AppLockerFileInformation line above) | New-AppLockerPolicy -ruletype publisher, hash -user everyone -XML Create a new Applocker Local GPO with that rule set: Get-AppLockerFileInformation -Directory 'C:\Program Files' -recurse -FileType exe | New-AppLockerPolicy -ruletype publisher, hash -user everyone | Set-AppLockerPolicy merge Create a new GPO AppLocker Policy: Get-AppLockerFileInformation -Directory 'C:\Program Files' recurse -FileType exe | New-AppLockerPolicy -ruletype publisher, hash -user everyone | Set-AppLockerPolicy -LDAP "LDAP://DC.fabrikam.com/CN={4391FF D-4BBE-B83E-4B536A09B543},CN=Policies,CN=System,DC=Fabrikam,DC=com" Dump a domain-based GPOs AppLocker rules: Get-AppLockerPolicy -Domain -LDAP "LDAP://DC.fabrikam.com/CN={4391FF D-4BBE-B83E-4B536A09B543},CN=Policies,CN=System,DC=Fabrikam,DC=com XML > output.xml The applications for which a user is blocked: Step 1: Get-AppLockerPolicy -EFFECTIVE -Xml > output2.xml Step 2: Get-ChildItem -Path "C:\Program Files" -Recurse -Filter *.exe | Convert-Path | Test-AppLockerPolicy -XMLPolicy.\output2.xml What is the Springboard Series? To the IT pro, our goal is Be the definitive resource for Desktop IT pros Open, honest; show dont tell Information at right time, right level across Adoption Lifecycle Inside of Microsoft we are A turnkey IT pro engagement platform for depth and breadth The program to mobilize MS marketing and field to focus on desktop OS IT pros DEPLOYPILOTMANAGEEXPLOREDISCOVER one-Windows TechCenter in 10 languages Virtual Roundtable Events Springboard Technical Experts Panel Event Support and Resources Straight-talk Monthly Feature Articles and Overview Guides TalkingAboutWindows Video Blogs Sign up for TechEd 2011 and save $500 starting June 8 June 31 stYou can also register at the North America 2011 kiosk located at registration Join us in Atlanta next year