$PolicyPath = "$env:ProgramData\Child-Exe-Block.xml"

$AdminRule = [guid]::NewGuid().Guid
$WindowsRule = [guid]::NewGuid().Guid
$ProgramsRule = [guid]::NewGuid().Guid

$Policy = @"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">

    <FilePathRule
      Id="$AdminRule"
      Name="Správcovia môžu spustiť všetky EXE"
      Description=""
      UserOrGroupSid="S-1-5-32-544"
      Action="Allow">
      <Conditions>
        <FilePathCondition Path="*" />
      </Conditions>
    </FilePathRule>

    <FilePathRule
      Id="$WindowsRule"
      Name="Povoliť programy systému Windows"
      Description=""
      UserOrGroupSid="S-1-1-0"
      Action="Allow">
      <Conditions>
        <FilePathCondition Path="%WINDIR%\*" />
      </Conditions>
    </FilePathRule>

    <FilePathRule
      Id="$ProgramsRule"
      Name="Povoliť nainštalované programy"
      Description=""
      UserOrGroupSid="S-1-1-0"
      Action="Allow">
      <Conditions>
        <FilePathCondition Path="%PROGRAMFILES%\*" />
      </Conditions>
    </FilePathRule>

  </RuleCollection>
</AppLockerPolicy>
"@

$Policy | Set-Content -Path $PolicyPath -Encoding UTF8

sc.exe config appidsvc start=auto
Start-Service AppIDSvc
Set-AppLockerPolicy -XmlPolicy $PolicyPath

Write-Host ""
Write-Host "Blokovanie bolo nastavené. Reštartuj počítač."