DEPLOYING WINDOWS 10 APPLICATION CONTROL POLICY

MZONDERLAND 

First off I will say I am in the same situation and answers are very hard to find.  Most of my answers come from trial and error so take it for what its worth.  I am also doing this with no SCCM.

I will try and answer what I can.

First off MSI installs do not bypass MDAC with managed installers.  The first link I sent does hint at that.  Hopefully Microsoft can address this.  My issue started with an MSI install but the latest version from the vender switched to an exe.

I used a script to  enable the managed installer through Intune.  I will paste it in at the end.

Only issue I see right now is I need to do an extra reboot until the app in question installs. so my autopilot application install fails on the first go.

I am going to try to package the script and deploy it as an app with a reboot required, then set dependencies on the other app not to install until it finishes.

Hope this helps.  Let me know if you have anymore questions, or make some progress that could be useful.

$policyFile =
@"
<AppLockerPolicy Version="1">
<RuleCollection Type="Dll" EnforcementMode="AuditOnly" >
<FilePathRule Id="86f235ad-3f7b-4121-bc95-ea8bde3a5db5" Name="Benign DENY Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
<Conditions>
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.dll" />
</Conditions>
</FilePathRule>
<RuleCollectionExtensions>
<ThresholdExtensions>
<Services EnforcementMode="Enabled" />
</ThresholdExtensions>
<RedstoneExtensions>
<SystemApps Allow="Enabled"/>
</RedstoneExtensions>
</RuleCollectionExtensions>
</RuleCollection>
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
<FilePathRule Id="9420c496-046d-45ab-bd0e-455b2649e41e" Name="Benign DENY Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
<Conditions>
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.exe" />
</Conditions>
</FilePathRule>
<RuleCollectionExtensions>
<ThresholdExtensions>
<Services EnforcementMode="Enabled" />
</ThresholdExtensions>
<RedstoneExtensions>
<SystemApps Allow="Enabled"/>
</RedstoneExtensions>
</RuleCollectionExtensions>
</RuleCollection>
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
<FilePublisherRule Id="55932f09-04b8-44ec-8e2d-3fc736500c56" Name="MICROSOFT.MANAGEMENT.SERVICES.INTUNEWINDOWSAGENT.EXE version 1.39.200.2 or greater in MICROSOFT® INTUNE™ from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
<Conditions>
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="MICROSOFT.MANAGEMENT.SERVICES.INTUNEWINDOWSAGENT.EXE">
<BinaryVersionRange LowSection="1.39.200.2" HighSection="*" />
</FilePublisherCondition>
</Conditions>
</FilePublisherRule>
</RuleCollection>
</AppLockerPolicy>
"@

$policyFile | Out-File ./ApplockerMI.xml

Set-AppLockerPolicy -XmlPolicy .\ApplockerMI.xml -Merge -ErrorAction SilentlyContinue

appidtel.exe start -mionly