Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 837665" data-attributes="member: 32260">H_C in any predefined profile (except All_OFF) blocks shortcuts in UserSpace (also for USB drives), except some whitelisted locations on hard disk like Desktop, Start Menu, etc.Shortcuts are blocked when SRP is set properly:<ol>
<li data-xf-list-type="ol">&lt;(Re)Install SRP&gt; = Installed</li>
<li data-xf-list-type="ol">LNK extension is on &lt;Designated File Types&gt;</li>
<li data-xf-list-type="ol">&lt;Default Security Level&gt; = Disallowed</li>
<li data-xf-list-type="ol">&lt;Enforcement&gt; = Skip Dlls (also All Files)</li>
<li data-xf-list-type="ol">&lt;More SRP ...&gt; &lt;Protect Shortcuts&gt; = ON</li>
</ol>People who do not like default-deny setup can use the predefined profile: Windows_10_MT_Windows_Security_hardeningwhich works similarly to SysHardener settings, but additionally block shortcuts, more file extensions, and some dangerous sponsors (mshta.exe, mstsc.exe, wmic.exe). If the user needs to run unsigned applications with elevation or install/update unsigned applications, then the option &lt;Validate Admin C.S.&gt; must be set to OFF.You may be sure that shortcuts are blocked by creating a shortcut on USB drive (or anywhere in the UserSpace) and trying to run it.</blockquote>

[QUOTE="Andy Ful, post: 837665, member: 32260"] H_C in [B]any predefined profile (except All_OFF)[/B] blocks shortcuts in UserSpace (also for USB drives), except some whitelisted locations on hard disk like Desktop, Start Menu, etc. Shortcuts are blocked when SRP is set properly: [LIST=1] [*]<(Re)Install SRP> = Installed [*]LNK extension is on <Designated File Types> [*]<Default Security Level> = Disallowed [*]<Enforcement> = Skip Dlls (also All Files) [*]<More SRP ...> <Protect Shortcuts> = ON [/LIST] People who do not like default-deny setup can use the predefined profile: [COLOR=rgb(0, 168, 133)][B]Windows_10_MT_Windows_Security_hardening[/B][/COLOR] which works similarly to SysHardener settings, but additionally block shortcuts, more file extensions, and some dangerous sponsors (mshta.exe, mstsc.exe, wmic.exe). If the user needs to run unsigned applications with elevation or install/update unsigned applications, then the option[B] <Validate Admin C.S.> must be set to OFF[/B]. You may be sure that shortcuts are blocked by creating a shortcut on USB drive (or anywhere in the UserSpace) and trying to run it. [/QUOTE]

Verification