Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839132" data-attributes="member: 32260">After some weeks of using the current profile, you can try to harden it a little:<ol>
<li data-xf-list-type="ol">From the left panel options, use the option &lt;Block Sponsors&gt; and &lt;ADD&gt; (below Enhanced label).</li>
<li data-xf-list-type="ol">From the right panel options set &lt;Block PowerShell Scripts&gt; = ON </li>
<li data-xf-list-type="ol">From the right panel options set &lt;Block Windows Script Host&gt; = ON</li>
</ol>Please remember, that adding these options can block something that you need, because the script blocking will be stronger and will be applied also on administrator level (points 2 and 3). That is why you should first wait a few weeks to be certain that the initial profile works well. If the new setup will become too restrictive then you can always load &quot;Windows_10_MT_Windows_Security...&quot; profile.As [USER=71262]@oldschool[/USER] already mentioned, you can also set &lt;Validate Admin C.S.&gt; to OFF, if you use unsigned applications that require admin rights to run or update.</blockquote>

[QUOTE="Andy Ful, post: 839132, member: 32260"] After some weeks of using the current profile, you can try to harden it a little: [LIST=1] [*]From the left panel options, use the option [B]<Block Sponsors>[/B] and [B]<ADD>[/B] (below Enhanced label). [*]From the right panel options set <Block PowerShell Scripts> = ON [*]From the right panel options set <Block Windows Script Host> = ON [/LIST] Please remember, that adding these options can block something that you need, because the script blocking will be stronger and will be applied also on administrator level (points 2 and 3). That is why you should first wait a few weeks to be certain that the initial profile works well. If the new setup will become too restrictive then you can always load "Windows_10_MT_Windows_Security..." profile. As [USER=71262]@oldschool[/USER] already mentioned, you can also set <Validate Admin C.S.> to OFF, if you use unsigned applications that require admin rights to run or update. [/QUOTE]

Verification