Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1011985">Now you are confusing me&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />&nbsp;&nbsp; (assuming Andy-san is right and I am making wrong rookie assumptions <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> )1. This is the reason I am looking at AppLocker: Blockrules for sponsors with an allow rule for Admins (to allow updates and legitemate use of scriptors).2. WDAC with SmartAppControl policy&nbsp; (<a href="https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies" target="_blank">link</a>) and path allow rules for Windows and Program Files should do the trick.So by combining AppLocker and WDAC I had hoped to achieve both, but you made me start doubting now <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite123" alt=":cry:" title="Crying&nbsp; &nbsp; :cry:" loading="lazy" data-shortname=":cry:" /></blockquote>

[QUOTE="ForgottenSeer 97327, post: 1011985"] Now you are confusing me :unsure: (assuming Andy-san is right and I am making wrong rookie assumptions :) ) 1. This is the reason I am looking at AppLocker: Blockrules for sponsors with an allow rule for Admins (to allow updates and legitemate use of scriptors). 2. WDAC with SmartAppControl policy ([URL='https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies']link[/URL]) and path allow rules for Windows and Program Files should do the trick. So by combining AppLocker and WDAC I had hoped to achieve both, but you made me start doubting now :cry: [/QUOTE]

Verification