Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1011887">[USER=32260]@Andy Ful[/USER] two questions1. Why do you use filepath *.* with MSI and filepath * with scripts?2. Will your suggested workaround also work when copying the folders from Windows10 Pro to Windows11 Home?Thanks for all the information and help <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> I did not know about Aaronlocker, downloaded the Word file and reading it now.I am playing with an idea at the moment which aims to implement SWH-like hardening for basic users with two levels of hardening1. Creating SWH-like AppLocker policies forA) Basic user blocking scripts in user space and blocking Microsoft Recommended (and all old obsolete scriptors like CMD, Wscript and Cscript)B) Admin also allowing signed scripts2. Creating crossover of&nbsp; SWH and H_C like AppLocker policies for A) Basic user blocking in user space all scripts and unsigned programs in user space and blocking Microsoft Recommended (and all old obsolete scriptors like CMD, Wscript and Cscript)B) Admin blocking in user space all, except (allowing) signed scripts, signed programs and signed DLL&#039;&#039;sC) Blocking execution of user writeable folders in Windows for everyoneFrom what I remember AppLocker differentiating Admin and Basic user rules, one needs to run as Basic User to apply them, but&nbsp; with UAC on default, blocking unsigned to elevate, I&nbsp; think this would be together with ConfigureDefender on Max a solid security setup for the average user. My wife&#039;s laptop came with Windows11, so all essential stuff is (Windows) signed.</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1011887"] [USER=32260]@Andy Ful[/USER] two questions 1. Why do you use filepath *.* with MSI and filepath * with scripts? 2. Will your suggested workaround also work when copying the folders from Windows10 Pro to Windows11 Home? Thanks for all the information and help (y) I did not know about Aaronlocker, downloaded the Word file and reading it now. I am playing with an idea at the moment which aims to implement SWH-like hardening for basic users with two levels of hardening 1. Creating SWH-like AppLocker policies for A) Basic user blocking scripts in user space and blocking Microsoft Recommended (and all old obsolete scriptors like CMD, Wscript and Cscript) B) Admin also allowing signed scripts 2. Creating crossover of SWH and H_C like AppLocker policies for A) Basic user blocking in user space all scripts and unsigned programs in user space and blocking Microsoft Recommended (and all old obsolete scriptors like CMD, Wscript and Cscript) B) Admin blocking in user space all, except (allowing) signed scripts, signed programs and signed DLL''s C) Blocking execution of user writeable folders in Windows for everyone From what I remember AppLocker differentiating Admin and Basic user rules, one needs to run as Basic User to apply them, but with UAC on default, blocking unsigned to elevate, I think this would be together with ConfigureDefender on Max a solid security setup for the average user. My wife's laptop came with Windows11, so all essential stuff is (Windows) signed. [/QUOTE]

Verification