AppLocker Policy Design Assistant

One of the challenges in making an AppLocker policy is knowing where applications launch from. This query normalizes process launch paths through aliasing, then counts the number of processes launched from that path, how many distinct machines it was launched on, and how many distinct file names \ hashes these processes had. The path is broken into subfolders to help simplify analysis.