• Now retrieves Packaged App events;
• -EventLogNames parameter supports retrieving from named event logs, to support the use case when forwarded events are saved in event logs other than "ForwardedEvents";
• Removed all the field-omission switches (as part of the perf upgrade)

• No longer requires a saved .csv file; invoke it without parameters and Generate-EventWorkbook.ps1 retrieves events from the local computer and slices/dices the results into a multi-tabbed Excel workbook.

• The generated rule set now includes an inoperative rule that contains the date and time the rule set was generated to help differentiate policy versions, and to associate an in-use policy with a policy rule file with the same timestamp in its filename. You can retrieve this time stamp from the policy even after it has been imported into Group Policy:
• Added Get-AaronLockerTimestamp.ps1 to retrieve the generated timestamp from local policy, effective policy, or a saved policy XML file.
• Added DownloadAccesschk.ps1 to download the current version of AccessChk.exe from Sysinternals.
• Improvements to the workbook produced by Generate-EventWorkbook.ps1 (three user-focused tabs).
• Added -Objects switch to Get-AppLockerEvents.ps1 to output PSCustomObjects instead of CSV.
• Scan-Directories.ps1 produces more data, recognizes additional “default” root directories.

• Documentation updates, particularly in the area of Group Policy control;
• Blocks execution from writable alternate data streams on user-writable directories under the Windows and Program Files directories;
• Blocks older versions of Sysinternals BgInfo.exe that were not AppLocker-aware and allowed execution of unapproved VBScript files (N.B., release of an AppLocker-aware BgInfo.exe is imminent -- subscribe to the Sysinternals blog for notifications);
• Improvements to the information retrieved from event logs, including an additional date/time column that Excel can filter on, a file extension column that can help track files with non-standard extensions, and a label for when an event is associated with the built-in local administrator account;
• Additional info in the event workbook's Summary tab, and a new "Users and event counts" tab;
• Performance improvements in Generate-EventWorkbook.ps1;
• PowerShell v2 DLLs blocked with explicit deny rules instead of exceptions;
• Minor bug fixes.

AaronLocker is designed to make the creation and maintenance of robust, strict, AppLocker-based whitelisting rules as easy and practical as possible. The entire solution involves a small number of PowerShell scripts. You can easily customize rules for your specific requirements with simple text-file edits. AaronLocker includes scripts that document AppLocker policies and capture event data into Excel workbooks that facilitate analysis and policy maintenance. AaronLocker is designed to restrict program and script execution by non-administrative users. Note that AaronLocker does not try to stop administrative users from running anything they want – and AppLocker cannot meaningfully restrict administrative actions anyway. A determined user with administrative rights can easily bypass AppLocker rules. AaronLocker’s strategy can be summed up as: if a non-admin could have put a program or script onto the computer – i.e., it is in a user-writable directory – don’t allow it to execute unless it has already been specifically allowed by an administrator. This will stop execution if a user is tricked into downloading malware, if an exploitable vulnerability in a program the user is running tries to put malware on the computer, or if a user intentionally tries to download and run unauthorized programs. AaronLocker works on all supported versions of Windows that can provide AppLocker. A personal note: the name “AaronLocker” was Chris (@appcompatguy) Jackson’s idea – not mine – and I resisted it for a long time. I finally gave in because I couldn’t come up with a better name. The zip file contains full documentation, all the scripts, and sample outputs.

“Colorful” (???) theme on the left; “White” theme on the right.

HKU\sid\Software\Microsoft\Office\16.0\Common\UI Theme HKU\sid\Software\Microsoft\Office\16.0\Common\PendingUITheme

Path is HKU\sid\Software\Microsoft\Office\16.0\Common\UI Theme Path is HKU\sid\Software\Microsoft\Office\16.0\Common\PendingUITheme

Six hours of Procmon trace monitoring two registry values, highlighting the “write” events, and dropping all other events.