Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1029876">Okay, I bookmarked [USER=98858]@SpyNetGirl[/USER] github, but so much hard work should be rewarded with a sticky in Microsoft Security forum section IMO.To be honest in 2019, it took me less than an half an hour to setup my first WDAC. Half the time spend on making an image backup&nbsp; and creating a Macrium reflect recovery USB and testing this recovery fallback option (using this USB).Until now I have not implemented the Microsoft Recommended blacklist in WDAC, but in SRP for SUA. I will move the ones which are blocked by SAC to WDAC (thanks [USER=71262]@oldschool[/USER]) and keep the remaining LoLBins in SRP blacklist merged with the ones Microsoft adviced for Windows-S (thanks [USER=98186]@Oerlink[/USER]) and use [USER=98858]@SpyNetGirl[/USER] script to automate the update of the driver blacklist.I thought that I had the most restricted Windows setup of MT, but read that Andy Full also implemented this at home a d guess SpyNetGirl will have a more tighter setup considering the stuff she posted on WDAC and Windos hardening (my Microsof hardening also dates back to 2019)</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1029876"] Okay, I bookmarked [USER=98858]@SpyNetGirl[/USER] github, but so much hard work should be rewarded with a sticky in Microsoft Security forum section IMO. To be honest in 2019, it took me less than an half an hour to setup my first WDAC. Half the time spend on making an image backup and creating a Macrium reflect recovery USB and testing this recovery fallback option (using this USB). Until now I have not implemented the Microsoft Recommended blacklist in WDAC, but in SRP for SUA. I will move the ones which are blocked by SAC to WDAC (thanks [USER=71262]@oldschool[/USER]) and keep the remaining LoLBins in SRP blacklist merged with the ones Microsoft adviced for Windows-S (thanks [USER=98186]@Oerlink[/USER]) and use [USER=98858]@SpyNetGirl[/USER] script to automate the update of the driver blacklist. I thought that I had the most restricted Windows setup of MT, but read that Andy Full also implemented this at home a d guess SpyNetGirl will have a more tighter setup considering the stuff she posted on WDAC and Windos hardening (my Microsof hardening also dates back to 2019) [/QUOTE]

Verification