Windows AppLocker允许全局路径后无法阻止指定应用的问题求助

最近我在测试AppLocker规则配置，需求很明确：先给Everyone组设置允许所有路径（*）的规则，再通过例外来阻止Google Chrome。之前几周这么配置都好好的，结果今天突然不管用了，Chrome完全不受限制，这可把我愁坏了。

我已经折腾了好几种办法，都没解决：

• 专门搭了全新的测试虚拟机来排查环境问题
• 分别用本地组策略编辑器（gpedit）手动创建规则、PowerShell脚本生成规则两种方式都试了
• 每次修改后都执行了gpupdate /force强制刷新组策略

下面是我用的示例XML（和我实际配置的问题一致，不是原配置但同样失效）：

<AppLockerPolicy Version="1">

<RuleCollection Type="Appx" EnforcementMode="Enabled">

<FilePublisherRule Id="c8fdd3d9-7143-4c1f-9879-a202f857d24c" Name="Allow All signed packaged apps" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow">

<Conditions>

<FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">

<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />

</FilePublisherCondition>

</Conditions>

</FilePublisherRule>

</RuleCollection>

<RuleCollection Type="Dll" EnforcementMode="Enabled" />

<RuleCollection Type="Exe" EnforcementMode="Enabled">

<FilePathRule Id="37652e3e-77a5-4f50-87d6-4e5117261afd" Name="*" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">

<Conditions>

<FilePathCondition Path="*" />

</Conditions>

<Exceptions>

<FilePublisherCondition PublisherName="O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" ProductName="GOOGLE CHROME" BinaryName="*">

<BinaryVersionRange LowSection="*" HighSection="*" />

</FilePublisherCondition>

</Exceptions>

</FilePathRule>

<RuleCollectionExtensions>

<ThresholdExtensions>

<Services EnforcementMode="Enabled" />

</ThresholdExtensions>

<RedstoneExtensions />

</RuleCollectionExtensions>

</RuleCollection>

<RuleCollection Type="Msi" EnforcementMode="Enabled">

<FilePathRule Id="49471136-3ca5-4443-8d15-8f36dfb55f66" Name="*" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">

<Conditions>

<FilePathCondition Path="*" />

</Conditions>

</FilePathRule>

</RuleCollection>

<RuleCollection Type="Script" EnforcementMode="Enabled">

<FilePathRule Id="deca722f-798c-4615-ae4c-6bd73bfe1ba5" Name="*" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">

<Conditions>

<FilePathCondition Path="*" />

</Conditions>

</FilePathRule>

</RuleCollection>

</AppLockerPolicy>

有没有大佬能帮我看看问题出在哪？之前好好的突然就失效了，实在摸不着头脑。

备注：内容来源于stack exchange，提问作者Niclas Reutter