search

PowerShell / WindowsCompatibility

Module that allows Windows PowerShell Modules to be used from PSCore6
Other
137 stars 33 forks source link

Applocker module not working correctly #88

Closed jschpp closed 3 years ago

jschpp commented 3 years ago

There are a few problems when using the AppLocker module in PS7.

Type Problem

Get-AppLockerFileInformation -Directory "C:\path\to\executable\" -FileType exe | New-AppLockerPolicy -Xml

fails. After trying it in another way

New-AppLockerPolicy -Xml -FileInformation (Get-AppLockerFileInformation -Directory "C:\path\to\executable\" -FileType exe)

the error is:

type Deserialized.Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.FileInformation cannot be converted to Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.FileInformation

Strange behavior when trying to create more then one rule type

When using the example from the documentation in PS7 it doesn't return anything.

Get-AppLockerFileInformation -Directory C:\Windows\system32\ -Recurse -FileType exe, script

The above will not return anything. Calling Get-AppLockerFileInformation twice; Once with FileType script and once with FileType exe will return the correct values for scripts and executables respectively.

I'm not sure why this is.

Powershell version information

\$PSVersionTable | Format-MarkdownTableListStyle

Property Value
GitCommitId 7.1.0
OS Microsoft Windows 10.0.18363
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0, 5.0, 5.1.10032.0, 6.0.0, 6.1.0, 6.2.0, 7.0.0, 7.1.0}
PSEdition Core
PSRemotingProtocolVersion 2.3
PSVersion 7.1.0
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
jschpp commented 3 years ago

... I just realized importing with -SkipEditionCheck fixes my Problems...