Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1029123" data-attributes="member: 32260">On Windows 11, Microsoft introduced something new: LowBox Token Permissive Learning Mode.It is possible that it is used in two non-standard (identical) AppLocker policy files: Exe.AppLocker and Dll.AppLocker. These policies are applied by default after installing Windows 11 ver. 22H2.[ATTACH=full]273423[/ATTACH]We can see the important strings:<ul>
<li data-xf-list-type="ul">S-1-15-2-1&nbsp;&nbsp; ----&gt; the SID of APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES</li>
<li data-xf-list-type="ul">LowBox&nbsp; ----&gt; the&nbsp; original&nbsp; codename&nbsp; for&nbsp; AppContainer</li>
</ul>From the article about LowBox Token Permissive Learning Mode, it follows that:These two AppLocker policies were introduced by Microsoft without using GPO, so they are invisible on Windows 11 Pro via secpol.msc or gpedit.msc (also via PowerShell cmdlets). They are also the source of the trouble with SRP on Windows 11. One can switch OFF/ON the AppLocker by using the reg tweak:[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]&quot;RuleCount&quot;=dword:00000000&nbsp; ---&gt; AppLocker switched OFF, rules inactive (but not removed) ---&gt; SRP works.&quot;RuleCount&quot;=dword:00000002 ---&gt;&nbsp; AppLocker switched ON, and the previous rules activated again.When SAC on Windows 11 is OFF, then one can delete this registry value which is the same as setting it to 0. The deleted value will not be restored after restarting Windows. This tweak can be used to turn ON SRP.Anyway, when SAC is in Evaluate or ON mode, the value (&quot;RuleCount&quot;=dword:00000002) is restored after restarting Windows, so deleting it will not help to turn ON SRP. One has to set &quot;RuleCount&quot;=dword:00000000. If so, then the previous value will not be restored after restarting Windows. This tweak can be used to turn ON SRP when SAC is set to any mode.</blockquote>

[QUOTE="Andy Ful, post: 1029123, member: 32260"] On Windows 11, Microsoft introduced something new: LowBox Token Permissive Learning Mode. It is possible that it is used in two non-standard (identical) AppLocker policy files: Exe.AppLocker and Dll.AppLocker. These policies are applied by default after installing Windows 11 ver. 22H2. [ATTACH type="full" alt="1678306279768.png"]273423[/ATTACH] We can see the important strings: [LIST] [*]S-1-15-2-1 ----> the SID of APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES [*]LowBox ----> the original codename for AppContainer [/LIST] From the article about LowBox Token Permissive Learning Mode, it follows that: These two AppLocker policies were introduced by Microsoft without using GPO, so they are invisible on Windows 11 Pro via secpol.msc or gpedit.msc (also via PowerShell cmdlets). They are also the source of the trouble with SRP on Windows 11. One can switch OFF/ON the AppLocker by using the reg tweak: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp] "RuleCount"=dword:00000000 ---> AppLocker switched OFF, rules inactive (but not removed) ---> SRP works. "RuleCount"=dword:00000002 ---> AppLocker switched ON, and the previous rules activated again. When SAC on Windows 11 is OFF, then one can delete this registry value which is the same as setting it to 0. The deleted value will not be restored after restarting Windows. This tweak can be used to turn ON SRP. Anyway, when SAC is in Evaluate or ON mode, the value ("RuleCount"=dword:00000002) is restored after restarting Windows, so deleting it will not help to turn ON SRP. One has to set "RuleCount"=dword:00000000. If so, then the previous value will not be restored after restarting Windows. This tweak can be used to turn ON SRP when SAC is set to any mode. [/QUOTE]

Verification