Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1012300">When running Standard User (SUA), I don&#039;t want sponsors blocked on Admin account. The border between SUA and ADMIN is considered by specialists as a security protection (UAC is not according to Microsoft). For average users (like me and my wife) there is no reason running ADMIN.Your info has changed my initial idea. When my wife&#039;s laptop updates to Windows11H2, I will use the SmartAppControl policy as a starting point, with path allow rules for UAC protected folders and enabling the option to exclude DLL&#039;s and dotNet protection. Next I will adopt your powershell scripts for AppLocker blocking sponsors and unsigned DLL&#039;s for SUA with exe ALLOW for admin and an exception for the folder containing PhotoBook Application in regard to signed DLL&#039;s.To deal with the unsigned DLL-folder hole, I will remove access write permissions for that folder except for Admin (that folder will also be protected by Controlled Folder Access). As mentioned earlier adding Code Integrity Guard to all Microsoft user programs (and Windows processes running as SUA) and Denying non Micorosft programs to launch other programs (also with MD Exploit Protection) AND blocking sponsors for SUA only (iclucing RunDLL32 etcera) will provide sufficient protection against staged&nbsp; DLL-injection attacks (I also use your Configure Defender at MAX on my wife&#039;s laptop).Thanks for all your feedback and efforts to bring AppLocker to Home users.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="ForgottenSeer 97327, post: 1012300"] When running Standard User (SUA), I don't want sponsors blocked on Admin account. The border between SUA and ADMIN is considered by specialists as a security protection (UAC is not according to Microsoft). For average users (like me and my wife) there is no reason running ADMIN. Your info has changed my initial idea. When my wife's laptop updates to Windows11H2, I will use the SmartAppControl policy as a starting point, with path allow rules for UAC protected folders and enabling the option to exclude DLL's and dotNet protection. Next I will adopt your powershell scripts for AppLocker blocking sponsors and unsigned DLL's for SUA with exe ALLOW for admin and an exception for the folder containing PhotoBook Application in regard to signed DLL's. To deal with the unsigned DLL-folder hole, I will remove access write permissions for that folder except for Admin (that folder will also be protected by Controlled Folder Access). As mentioned earlier adding Code Integrity Guard to all Microsoft user programs (and Windows processes running as SUA) and Denying non Micorosft programs to launch other programs (also with MD Exploit Protection) AND blocking sponsors for SUA only (iclucing RunDLL32 etcera) will provide sufficient protection against staged DLL-injection attacks (I also use your Configure Defender at MAX on my wife's laptop). Thanks for all your feedback and efforts to bring AppLocker to Home users.(y) [/QUOTE]

Verification