Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 774331" data-attributes="member: 32260">I have just tested another possibility. The user can create the special, restricted SUA account for MS Office only:<ol>
<li data-xf-list-type="ol">MS Office on SUA.</li>
<li data-xf-list-type="ol">Local SRP high restrictions.</li>
</ol>SRP can apply high restrictions similar to Hard_Configurator max restrictions with blocked sponsors, but only on that special account. Other accounts will not be restricted by SRP at all. The local restrictions are applied via local policies, so the malware ran as standard user cannot change them. The SUA accounts can be also forced to not elevate processes, so any malware (also digitally signed) cannot elevate on such restricted SUA. I could make such restricted account in 5 minutes by transferring the registry keys from HKLM Hive (made by H_C) to HKU Hive created by SUA.</blockquote>

[QUOTE="Andy Ful, post: 774331, member: 32260"] I have just tested another possibility. The user can create the special, restricted SUA account for MS Office only: [LIST=1] [*]MS Office on SUA. [*][COLOR=rgb(184, 49, 47)][B]Local SRP high restrictions.[/B][/COLOR] [/LIST] SRP can apply high restrictions similar to Hard_Configurator max restrictions with blocked sponsors, [B]but only on that special account[/B]. Other accounts will not be restricted by SRP at all. The local restrictions are applied via local policies, so the malware ran as standard user cannot change them. The SUA accounts can be also forced to not elevate processes, so any [B]malware (also digitally signed) cannot elevate[/B] on such restricted SUA. I could make such restricted account in 5 minutes by transferring the registry keys from HKLM Hive (made by H_C) to HKU Hive created by SUA. [/QUOTE]

Verification