Hard_Configurator - Windows Hardening Configurator

[wat0114]

But, I do not recommend using H_C on Windows 11, because no one knows how it will work after the next update.

Even 21H2? Because I thought the only current concern was 22H2.

 

[ErzCrz]

You have to test it. Copy the H_C shortcut to the Downloads folder and try to run it. It should be blocked if SRP works well. You can also create any shortcut in the Downloads folder and run it.

Thanks. It works on my machine I suppose we'll have to see what happens with next big Win 11 update but good to see it's working

 

[Andy Ful]

Even 21H2? Because I thought the only current concern was 22H2.

Some time ago I included the info in the OP.
https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/post-574990

 

[ForgottenSeer 97327]

I am glad Software Restriction Policies still work on Windows 11 devices which have Smart Application Control disabled. First it felt like being excluded from a new feature, now I am thankful for still having this Windows XP feature on my wife's laptop. I find H_C easier to use than secpol.msc, so thanks for your great tools

 

[Victor M]

Software Restriction Policy is NOT FUNCTIONAL in Win 11.

 

[oldschool]

Software Restriction Policy is NOT FUNCTIONAL in Win 11.

Did you reset or clean install? It's supposed to work on 22H2 if you haven't. I've clean-installed so that ship has sailed for me.

 

[ForgottenSeer 98186]

Software Restriction Policy is NOT FUNCTIONAL in Win 11.

SRP only works on systems upgraded from Windows 10 to 11 22H2.

SRP does not work on 1) OEM Windows 11 22H2 and 2) clean installs of Windows 11 22H2.

Enterprise administrators are complaining about it being broken. Perhaps the horde's discontent will compel Microsoft to fix it.

 

[ForgottenSeer 97327]

My wife's HP laptop came with Windows11. I bought it online and with free update service (bios, drivers etc) and doa check. The update service did not mention updating Windows. The laptop had Windows 11 installed and executed first run settings initialization procedure (so I assumed it came with clean installed Windows11). It now runs 22H2 with SAC switched off and SRP is fully functional.

 

[Andy Ful]

SRP seems dysfunctional on Windows 11 due to SAC, although there is no official note from Microsoft. SAC works on the systems in Europe and North America. Some people reported that it did not work after updating Windows 11 to ver. 22H2 (from previous Windows 11 versions) and some reported that SRP still works.
The problem is that Microsoft is silent about this issue, so there can be some surprises in the future.

 

[pxxb1]

SRP seems dysfunctional on Windows 11 due to SAC, although there is no official note from Microsoft. SAC works on the systems in Europe and North America. Some people reported that it did not work after updating Windows 11 to ver. 22H2 (from previous Windows 11 versions) and some reported that SRP still works.
The problem is that Microsoft is silent about this issue, so there can be some surprises in the future.

Hi Andy

I use NTLite, which i think you are familiar with, to remove items from my Os, if i remove SAC, would H_C or SWH function ok?

 

[Andy Ful]

Hi Andy

I use NTLite, which i think you are familiar with, to remove items from my Os, if i remove SAC, would H_C or SWH function ok?

If the system is based on Windows 11 22H2 and the region (Europe, North America) is supported, then probably not.

 

[pxxb1]

If the system is based on Windows 11 22H2 and the region (Europe, North America) is supported, then probably not.

Forgot to mention that, yes W11 22H2. Probably not you say, that you have to clarify because i can not see, do not understand why not.

 

[Andy Ful]

Forgot to mention that, yes W11 22H2. Probably not you say, that you have to clarify because i can not see, do not understand why not.

The information about the source of the issue is insufficient. I doubt if it is possible to remove SAC and all dependencies with the help of NTLite, so most probably SRP will not work. Anyway, I will not insist that I am right, because I did not test it.

 

[pxxb1]

The information about the source of the issue is insufficient. I doubt if it is possible to remove SAC and all dependencies with the help of NTLite, so most probably SRP will not work. Anyway, I will not insist that I am right, because I did not test it.

Yeah, you are right. The issue is surrounded by a lot of uncertainties.

 

[Griz]

I read a blog where someone was able to solve the problem. After deleting the keys SRP should work again. Can anyone confirm this?

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000002
"LastWriteTime"=hex(b):01,00,00,00,00,00,00,00

Software Restriction Policies (SAFER) still possible under Windows 11 22H2 …

[German]We was told, that Software Restriction Policies and SAFER no longer work out-of-the-box under Windows 11 22H2. This is caused by registry entries left in the ISO images, that make Windows 11…

borncity.com

Here you can also read that there is a bypass in SRP and how to close it.
The bypass nonsensically allows restricted users to create subdirectories in %SystemDrive%.
A Demonstration and how to prevent.

Prevent Bypass of AppLocker and SAFER alias Software Restriction Policies

skanthak.homepage.t-online.de

 

[oldschool]

I read a blog where someone was able to solve the problem. After deleting the keys SRP should work again. Can anyone confirm this?

Read the posts above.

 

[Gandalf_The_Grey]

I read a blog where someone was able to solve the problem. After deleting the keys SRP should work again. Can anyone confirm this?

Software Restriction Policies (SAFER) still possible under Windows 11 22H2 …

[German]We was told, that Software Restriction Policies and SAFER no longer work out-of-the-box under Windows 11 22H2. This is caused by registry entries left in the ISO images, that make Windows 11…

borncity.com

Here you can also read that there is a bypass in SRP and how to close it.
The bypass nonsensically allows restricted users to create subdirectories in %SystemDrive%.
A Demonstration and how to prevent.

Prevent Bypass of AppLocker and SAFER alias Software Restriction Policies

skanthak.homepage.t-online.de

After some trial and error, I found out that the Kanthak correction can be simplified by the tweak:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000000

Simply, one has to correct the invalid number of Applocker rules under this key (there are no rules at all). This value will not change, because SAC uses WDAC policies to control AppLocker, so no policies are added under this key.
This tweak works well with SAC, also if it is turned ON.

Discussed here:

Deprecated - Windows 11 22H2 no longer supports Software Restriction Policies (SRP)

A brief note to Windows administrators who still rely on Software Restriction Policies (SRP). This security feature has been deprecated since 2020, but is still supported in Windows 10. But Windows 11 version 22H2 will definitely put an end to the use of Software Restriction Policies –...

malwaretips.com

@Andy Ful Do you have plans to update the first post an your GitHub page with this info?

 

[Tiamati]

Do i have to uninstall old H_C before install the new version? I'm using v. 6.0.0.0

(i'm sorry if you already have answered this before, i didn't find it)

 

[oldschool]

Do i have to uninstall old H_C before install the new version? I'm using v. 6.0.0.0

(i'm sorry if you already have answered this before, i didn't find it)

Are you on Windows 11? If so, please read GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

Haven't used this in a while but isn't there an "Update" button in your version?

 

[Tiamati]

Are you on Windows 11? If so, please read GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

Haven't used this in a while but isn't there an "Update" button in your version?

I didn't see any update button.

I'm using windows 10, last build...