Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1121759" data-attributes="member: 32260">Thanks for providing the script, although users can simply run H_C to see if the left panel is active.I think that one script might be enough.[CODE]#Script confirms the state of SRP (ON/OFF) settings in Hard_Configurator.# Define the registry path and value name$RegistryPath = &#039;HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\CodeIdentifiers&#039;$ValueName = &#039;TurnOFFAllSRP&#039;# Check if the registry key existsif (Test-Path $RegistryPath) {&nbsp; &nbsp; # Get the registry value&nbsp; &nbsp; $RegistryValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue&nbsp; &nbsp; # Check if the value exists and equals &#039;1&#039;&nbsp; &nbsp; if ($RegistryValue.$ValueName -eq &#039;1&#039;) {&nbsp; &nbsp; &nbsp; &nbsp; Write-Output &#039;SRP settings in H_C are turned OFF.&#039;&nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; Write-Output &#039;SRP settings in H_C are turned ON.&#039;&nbsp; &nbsp; }} else {&nbsp; &nbsp; Write-Output &#039;SRP settings in H_C are turned OFF.&#039;}[/CODE]A similar scripting code can be inserted into the batch script that runs PowerShell with CmdLines. The batch script can be whitelisted in SRP and added to autoruns (whitelisted batch script works even if cmd[.]exe is blocked in SRP). Otherwise, the PowerShell script would be blocked by &lt; Block PowerShell Scripts &gt;.The code can be modified to show the alert only if SRP settings are Switched OFF.Post edited.Another possibility is creating a batch file that runs SwitchDefaultDeny (instead of alert), when SRP is Switched OFF. If SRP is turned ON or SRP is not installed, the script does nothing:[CODE]%Windir%\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -WindowStyle hidden $RegistryPath = &#039;HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\CodeIdentifiers&#039;; $ValueName = &#039;TurnOFFAllSRP&#039;; $RegistryValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue; if ($RegistryValue.$ValueName -eq &#039;1&#039;){Start-Process -FilePath $Env:WinDir&#039;\Hard_Configurator\SwitchDefaultDeny(x64).exe&#039;}[/CODE]</blockquote>

[QUOTE="Andy Ful, post: 1121759, member: 32260"] Thanks for providing the script, although users can simply run H_C to see if the left panel is active. I think that one script might be enough. [CODE]#Script confirms the state of SRP (ON/OFF) settings in Hard_Configurator. # Define the registry path and value name $RegistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\CodeIdentifiers' $ValueName = 'TurnOFFAllSRP' # Check if the registry key exists if (Test-Path $RegistryPath) { # Get the registry value $RegistryValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue # Check if the value exists and equals '1' if ($RegistryValue.$ValueName -eq '1') { Write-Output 'SRP settings in H_C are turned OFF.' } else { Write-Output 'SRP settings in H_C are turned ON.' } } else { Write-Output 'SRP settings in H_C are turned OFF.' }[/CODE] A similar scripting code can be inserted into the batch script that runs PowerShell with CmdLines. The batch script can be whitelisted in SRP and added to autoruns (whitelisted batch script works even if cmd[.]exe is blocked in SRP). Otherwise, the PowerShell script would be blocked by < Block PowerShell Scripts >. The code can be modified to show the alert only if SRP settings are Switched OFF. Post edited. Another possibility is creating a batch file that runs SwitchDefaultDeny (instead of alert), when SRP is Switched OFF. If SRP is turned ON or SRP is not installed, the script does nothing: [CODE]%Windir%\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -WindowStyle hidden $RegistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\CodeIdentifiers'; $ValueName = 'TurnOFFAllSRP'; $RegistryValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue; if ($RegistryValue.$ValueName -eq '1'){Start-Process -FilePath $Env:WinDir'\Hard_Configurator\SwitchDefaultDeny(x64).exe'}[/CODE] [/QUOTE]

Verification