Reply to thread

Message

<blockquote data-quote="Marana" data-source="post: 822895" data-attributes="member: 69370">Well, I think that my &quot;problem&quot; was in the opposite direction, so to say. For example, at default settings OSA apparently denies svchost.exe launching PowerShell, (&quot;Block suspicious Svchost.exe process behaviours&quot;?). Generally that&#039;s what I want, but with one exception: I want svchost.exe to be able to launch my daily backup. So I created an exception rule for OSA to allow svchost.exe to run my backup. Or actually I use Macrium for backups, but I use a powershell script to name the backup files, and Macrium seems to utlize svchost.exe in launching the backup job via Powershell.After a quick look to H_C I have not found a way to limit running powershell with as fine granularity as I have been able to do using OSA. Can you see a way to do this using only H_C?I think that if there were a command line interface to SwitchDefaultDeny (e.g. &quot;-on&quot; and &quot;-off&quot;) to switch the setting accordingly, that would be a workable solution. I wonder if there is a way to append this into the wish list...? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" /></blockquote>

[QUOTE="Marana, post: 822895, member: 69370"] Well, I think that my "problem" was in the opposite direction, so to say. For example, at default settings OSA apparently denies svchost.exe launching PowerShell, ("Block suspicious Svchost.exe process behaviours"?). Generally that's what I want, but with one exception: I want svchost.exe to be able to launch my daily backup. So I created an exception rule for OSA to allow svchost.exe to run my backup. Or actually I use Macrium for backups, but I use a powershell script to name the backup files, and Macrium seems to utlize svchost.exe in launching the backup job via Powershell. After a quick look to H_C I have not found a way to limit running powershell with as fine granularity as I have been able to do using OSA. Can you see a way to do this using only H_C? I think that if there were a command line interface to SwitchDefaultDeny (e.g. "-on" and "-off") to switch the setting accordingly, that would be a workable solution. I wonder if there is a way to append this into the wish list...? ;) [/QUOTE]

Verification