Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 973888" data-attributes="member: 32260">The H_C and SWH can also prevent admins to overrule the Software Restriction Policies. The H_C must be run with &quot;-p&quot; switch and SWH has got a special option * Policy Scope * . I do not recommend preventing admins in H_C, except for Basic_Recommended_Settings + a few Sponsors blocked.These settings can be loaded via the Windows_10_Basic_Recommended setting profile.In H_C, one can use &lt;Block Sponsors&gt;&nbsp; and &quot;Script Interpreters&quot; &lt;ON&gt; + &quot;Enhanced&quot; &lt;ON&gt; to block popular script interpreters and LOLBins. This is a better solution compared to GPO, because the blocked events can be easily seen via &lt;Tools&gt;&lt;Blocked Events / Security Logs&gt;.If the computer is used both at home and work, then it is possible to prevent also admins to bypass SRP (-p switch).<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 973888, member: 32260"] The H_C and SWH can also prevent admins to overrule the Software Restriction Policies. The H_C must be run with "-p" switch and SWH has got a special option * Policy Scope * . I do not recommend preventing admins in H_C, except for Basic_Recommended_Settings + a few Sponsors blocked. These settings can be loaded via the Windows_10_Basic_Recommended setting profile. In H_C, one can use <Block Sponsors> and "Script Interpreters" <ON> + "Enhanced" <ON> to block popular script interpreters and LOLBins. This is a better solution compared to GPO, because the blocked events can be easily seen via <Tools><Blocked Events / Security Logs>. If the computer is used both at home and work, then it is possible to prevent also admins to bypass SRP (-p switch).(y) [/QUOTE]

Verification