AI Tells It Like It Is - Microsoft's Wonky Default Deny Roadmaps, Users as Guinea Pigs, "Dilemmas and Paradoxes," and Why SRP Remains King

[Parkinsond]

Just curious.
Local Standard Account
or
Microsoft Standard Account?

Local admin

 

[Andy Ful]

This is precisely why I argue that Smart App Control (SAC) is the necessary evolution for the general public. It attempts to bridge that "Acceptance Gap." By offloading the verification decision to Microsoft's cloud intelligence rather than forcing the user to be the admin/judge for every execution, it maintains the "Default Deny" posture without the friction that causes users to "not accept it." It solves the psychological problem, not just the kernel problem.

You may be right. I'm keeping my fingers crossed.

 

[Andy Ful]

So bottom line conclusion is that my wife is relatively safe (100% can't be achieved) on her Windows 11 laptop running as standard user with SAC enabled plus SRP blocking scripts and LoLbins for standard users accomplished by Defender running in zero tolerance (max) mode?

Yes. I know that you also hardened the web browser.

 

[LinuxFan58]

Yes. I know that you also hardened the web browser.

yes with GPO (e.g. only allowing a few extensions and reducing website permissions and increasing download restrictions), hope that is all you know of my wife's laptop

 

[silversurfer]

Everyone, please stop off-topic comments here.
For your mentioned suggestions you can post there: Community Feedback