Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 745731" data-attributes="member: 32260">If the user (like [USER=37647]@shmu26[/USER]) has to use the vulnerable applications (like MS Office with allowed macros), then the best practice is using the custom restricted SUA for those applications. This can be made by using the Hard_Configurator profiles: Windows_10_NoElevationSUA_Enhanced, Windows_8_NoElevationSUA_Enhanced or Windows_7_NoElevationSUA_Enhanced.The above is especially convenient when those applications are updated via Windows Updates or via Task Scheduler (as Administrator). This is also a limitation for such SUA, because there are not many applications which can update is such way. Sometimes it is possible to force an application to update via Task Scheduler by adding the custom task. Alternatively, the user can make updates manually on Admin Account.</blockquote>

[QUOTE="Andy Ful, post: 745731, member: 32260"] If the user (like [USER=37647]@shmu26[/USER]) has to use the vulnerable applications (like MS Office with allowed macros), then the best practice is using the custom restricted SUA for those applications. This can be made by using the Hard_Configurator profiles: [COLOR=rgb(0, 168, 133)][B]Windows_10_NoElevationSUA_Enhanced[/B][/COLOR], [COLOR=rgb(41, 105, 176)][B]Windows_8_NoElevationSUA_Enhanced[/B][/COLOR] or [COLOR=rgb(85, 57, 130)][B]Windows_7_NoElevationSUA_Enhanced.[/B][/COLOR] [COLOR=rgb(0, 0, 0)]The above is especially convenient when those applications are updated via Windows Updates or via Task Scheduler (as Administrator).[/COLOR] This is also a limitation for such SUA, because there are not many applications which can update is such way. Sometimes it is possible to force an application to update via Task Scheduler by adding the custom task. Alternatively, the user can make updates manually on Admin Account. [/QUOTE]

Verification