[release/v7.4] Fallback to AppLocker after `WldpCanExecuteFile` by TravisEz13 · Pull Request #25229 · PowerShell/PowerShell

Backport #24912

This pull request includes several changes to the src/System.Management.Automation/security/wldpNativeMethods.cs file to improve the handling of system lockdown policies and file policy enforcement. The changes primarily focus on refining the logic for determining enforcement modes and handling exceptions more effectively.

Key changes include:

Improvements to system lockdown policy handling:

  • Modified the GetSystemLockdownPolicy method to use an out parameter for GetDebugLockdownPolicy.
  • Added a new method ConvertToModernFileEnforcement to convert legacy enforcement modes to modern file enforcement modes.

Enhancements to file policy enforcement:

  • Updated the GetFilePolicyEnforcement method to use the new ConvertToModernFileEnforcement method and added logic to handle different enforcement scenarios more accurately.
  • Introduced the TryGetWldpCanExecuteFileResult method to handle the result of WldpCanExecuteFile and fallback to legacy APIs if necessary.

Exception handling improvements:

  • Refined the exception handling in GetFilePolicyEnforcement to catch both DllNotFoundException and EntryPointNotFoundException and log the appropriate events.

Additional minor changes:

  • Added System.Diagnostics using directive for better debugging support.
  • Adjusted the GetDebugLockdownPolicy method to use an out parameter for modern enforcement. [1] [2] [3]

These changes collectively enhance the robustness and accuracy of the system's lockdown policy and file enforcement mechanisms.