Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 796155" data-attributes="member: 32260">Avast profile and &#039;UAC deny elevation of unsigned&#039; The UAC setting ValidateAdminCodeSignatures = 1, applies the policy to block elevation of applications (enforce cryptographic signatures on any interactive application that requests elevation of privilege).This setting can probably block about 80% of malware on SUA (but not on Admin account because of UAC bypasses). It is not required when one uses H_C default-deny, but can be useful on H_C default allow setup. In the case of default-allow setup proposed by [USER=50782]@Windows_Security[/USER], one can first apply H_C Avast profile (with any AV, not necessarily with Avast) and next, apply &#039;UAC deny elevation of unsigned&#039; by registry tweak (ValidateAdminCodeSignatures = 1).If running H_C or installing the new application is required, then first &#039;UAC deny elevation of unsigned&#039; must be deactivated (ValidateAdminCodeSignatures = 0), and then H_C or application installer will be allowed to run with elevation. After this, the user can apply &#039;UAC deny elevation of unsigned&#039; again (ValidateAdminCodeSignatures = 1).The above is not the usual way of using H_C, because it is suited to default-deny setup.</blockquote>

[QUOTE="Andy Ful, post: 796155, member: 32260"] [B]Avast profile and 'UAC deny elevation of unsigned' [/B] The UAC setting ValidateAdminCodeSignatures = 1, applies the policy to block elevation of applications (enforce cryptographic signatures on any interactive application that requests elevation of privilege). This setting can probably block about 80% of malware on SUA (but not on Admin account because of UAC bypasses). It is not required when one uses H_C default-deny, but can be useful on H_C default allow setup. In the case of default-allow setup proposed by [USER=50782]@Windows_Security[/USER], one can first apply H_C Avast profile (with any AV, not necessarily with Avast) and next, apply 'UAC deny elevation of unsigned' by registry tweak (ValidateAdminCodeSignatures = 1). If running H_C or installing the new application is required, then first 'UAC deny elevation of unsigned' must be deactivated (ValidateAdminCodeSignatures = 0), and then H_C or application installer will be allowed to run with elevation. After this, the user can apply 'UAC deny elevation of unsigned' again (ValidateAdminCodeSignatures = 1). The above is not the usual way of using H_C, because it is suited to default-deny setup. [/QUOTE]

Verification