The WinOps Blog

#specify the apps that needs to be blocked (comma separated).

$blockListedApps = @("app1.exe", "app2.exe", "app3.exe")

Write-Host "List of apps that will get blocked:--->"

Write-Host $blockListedApps -Separator ","

try{

    $status = New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS

    Function BlockApps($sid)

    {

        $policyPath = "HKU:\${sid}\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies"

        if(Test-Path $policyPath)

        {

            $ExplorerPath = $policyPath + "\Explorer"

            if(-not(Test-Path $ExplorerPath))

            {

                New-Item -Path $ExplorerPath -Force | Out-Null

            }

            New-ItemProperty -Path $ExplorerPath -Name "DisallowRun" -Value 1 -PropertyType DWord -Force | Out-Null

            $DisallowRunPath = $ExplorerPath + "\DisallowRun"

            if(-not(Test-Path $DisallowRunPath))

            {

                New-Item -Path $DisallowRunPath -Force | Out-Null

            }

            $count = 1

            Foreach($app in $blockListedApps)

            {

                New-ItemProperty -Path $DisallowRunPath -Name $count -Value $app -PropertyType STRING -Force | Out-Null

                $count++

            }

        }

        else

        {

            Write-Host "Unable to locate policies path, please check manually"

        }

    }

    $userDetails=Get-wmiobject win32_useraccount | where-object{$_.status -eq 'ok'}

    $loggedInUserCount = 0

    foreach($user in $userDetails){

        $sid=$user.SID

        $username = $user.Name

        if(Test-Path "HKU:\${sid}")

        {

            Write-Host $username,"is signed-in to the device."

            Write-Host "blocking apps for the user:",$username

            BlockApps($sid)

            $loggedInUserCount++

        } 

    }

    if($loggedInUserCount -eq 0)

    {

        Write-Host "Policy hasn't applied to any user, this policy can only be applied when the user is logged in to the device"

    }

    else

    {

        Write-Host "Restart the device to review the changes."

    }

}

catch

{

    Write-Host "Error occured while running script -> ",$_.Exception.Message

}

///////

# Spécifiez le nom de l'application que vous souhaitez interdire

$applicationName = "Nom de l'application"

# Récupérer l'ID de l'application à partir de SCCM

$application = Get-CMApplication | Where-Object { $_.LocalizedDisplayName -eq $applicationName }

# Vérifiez si l'application a été trouvée

if ($application -ne $null) {

    # Désactiver l'installation de l'application

    Set-CMApplication -Id $application.Id -AllowInstall $false

    Write-Host "L'installation de l'application '$applicationName' est désormais interdite."

} else {

    Write-Host "L'application '$applicationName' n'a pas été trouvée dans SCCM."

}