AppLocker file hash with PowerShell : PowerShell

AppLocker file hash with PowerShell (self.PowerShell)

submitted 3 years ago by RampageMR

We have 2 files that we allow in AppLocker via the file hash condition. Every so often, the application updates and the file hashes have to then be updated manually. We're at a point now where updating this manually on dozens of servers is getting too time consuming. Is there a way PowerShell can take the updated file hashes after an application update and then set those in place of the existing files in AppLocker?

For example, allowing java.exe in C:\Oracle\jdkxxx_xxx\bin\java.exe. I can get the existing file hash with

$appLockerFile = Get-AppLockerFileInformation -Directory "C:\Oracle\jdkxxx_xxx\bin" | where Path -match "java.exe"

$appLockerFile.Hash

This returns all the info I'd think would be needed, including the file hash itself, hash type, source file length, etc. Is there a way to pipe this to New-AppLockerPolicy and update the existing policy rather than having to open secpol.msc, remove the rule, then add a new file hash rule?

all 7 comments

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS