Get-AppLockerFileInformation

Get-AppLockerFileInformation is accessible with the help of AppLocker module. To configure AppLocker, go through this link.

Synopsis

Gets the file information necessary to create AppLocker rules from a list of files or an event log.

Description

The Get-AppLockerFileInformation cmdlet gets the AppLocker file information from a list of files or an event log. File information includes the publisher information, file hash, and file path.

The file information from an event log may not contain all of the publisher information, file hash, and file path fields. Files that are not signed will not have any publisher information.

Parameters

-Directory
Specifies the directory that contains the files for which to get the file information. If all subfolders and files in the specified directory are to be searched, then include the Recurse parameter

    Required?                    true
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EventLog <SwitchParameter>
    Specifies that the file information is retrieved from the event log.

    Required?                    true
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EventType <List<AppLockerEventType>>
    Specifies the event type by which to filter the events. The acceptable values for this parameter are: Allowed, Denied, or Audited. The event types correspond to the Informational, Error, and Warning level events in the AppLocker event logs.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-FileType <List<AppLockerFileType>>
    Specifies the generic file type for which to search. All files having the appropriate file name extension will be included. 
    The acceptable values for this parameter are: EXE, Script, MSI, and DLL.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-InformationAction <System.Management.Automation.ActionPreference>
    Specifies how this cmdlet responds to an information event. The acceptable values for this parameter are:

    -- SilentlyContinue
    -- Stop
    -- Continue
    -- Inquire
    -- Ignore
    -- Suspend

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-InformationVariable <System.String>
    Specifies a variable in which to store an information event message.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-LogPath <String>
    Specifies the log name or file path of the event log where the AppLocker events are located. By default, if this parameter is not specified, the local Microsoft-Windows-AppLocker/EXE and DLL channel is used.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Packages <List<AppxPackage>>
    Specifies a list of installed packaged applications, from which the file information is retrieved.

    Required?                    false
    Position?                    1
    Default value                none
    Accept pipeline input?       true (ByValue, ByPropertyName)
    Accept wildcard characters?  false

-Path <List<String>>
    Specifies a list of paths to the files from which the file information is retrieved. Supports regular expressions.

    Required?                    false
    Position?                    1
    Default value                none
    Accept pipeline input?       true (ByValue, ByPropertyName)
    Accept wildcard characters?  false

-Recurse <SwitchParameter>
    Specifies that all files and folders in the specified directory will be searched.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Statistics <SwitchParameter>
    Specifies the statistics to retrieve on the files included in the event log. Calculates a simple sum of the number of times a file is included in the event log based on specified parameters.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

Syntax

Get-AppLockerFileInformation [[-Path] <System.Collections.Generic.List`1[System.String]>] [<CommonParameters>]

Get-AppLockerFileInformation [[-Packages] <System.Collections.Generic.List`1[Microsoft.Windows.Appx.PackageManager.Commands.AppxPackage]>] [<CommonParameters>]

Get-AppLockerFileInformation -Directory <String> [-FileType <System.Collections.Generic.List`1[Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.AppLockerFileType]>] [-Recurse] [<CommonParameters>]

Get-AppLockerFileInformation [-EventLog] [-LogPath <String>] [-EventType <System.Collections.Generic.List`1[Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.AppLockerEventType]>] [-Statistics] [<CommonParameters>]

——————-EXAMPLE 1——————-
PS C:>Get-AppLockerFileInformation -Directory C:\Windows\system32\ -Recurse -FileType exe, script
This example gets the file information for all the .exe files and scripts under %windir%\system32.

——————-EXAMPLE 2——————-
PS C:>Get-AppLockerFileInformation -EventLog -EventType Audited
This example outputs the file information for all the Audited events in the local event log. Audited events correspond to the Warning event in the AppLocker audit log.

——————-EXAMPLE 4——————-
PS C:>Get- AppLockerFileInformation -EventLog -EventType Audited | New-AppLockerPolicy -RuleType Publisher, Hash, Path -User Everyone -Optimize | Set-AppLockerPolicy -LDAP LDAP://checkGPO
This example creates a new AppLocker policy from the warning events in the local event log and sets the policy of a check Group Policy Object (GPO).

You can check the Version, CommandType and Source of this cmdlet by giving below command.

Get-Command Get-AppLockerFileInformation

You can also read about

To know more PowerShell cmdlets(Commands) on AppLocker click here

Click on this Link for an Single place where you get all the PowerShell cmdlet sorted based on the modules.

You can also refer other blogs on PowerShell at link

You can also refer other blogs on Microsoft at link

And also if you required any technology you want to learn, let us know below we will publish them in our site http://tossolution.com/

Like our page in Facebook and follow us for New technical information.

References are taken from Microsoft