Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839475" data-attributes="member: 32260">Ha, ha. Yes, the correct name is &quot;Standard User&quot;.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" />Both &quot;Run As SmartScreen&quot; and &quot;Run By SmartScreen&quot; cannot automatically elevate privileges. &quot;Run As SmartScreen&quot; can only allow the user to run the executable elevated via UAC prompt. The UAC prompt is caused by the elevation request.&quot;Run By SmartScreen&quot; cannot force the executable to request the elevation of privileges, but the executable can still request it via the proper entry in the manifest. Yet, the file execution and this request will be blocked by SRP in the H_C default-deny setup (no UAC prompt).&quot;Run As SmartScreen&quot; forces any executable to request elevation and this request will bypass SRP (the user will see the UAC prompt).In my opinion, there is another important difference between &quot;Run By SmartScreen&quot; and &quot;Run As SmartScreen&quot;. The first is intended to open/run all files in unsafe locations. The user does not have to think about what file type is going to be opened. If it is a photo, then it will be opened without any alert. If it is a script, then it will be blocked with alert. If it is a native executable or MSI installer, then it will be blocked or allowed to run depending on the SmartScreen check. If it is an Office document, then the alert with some instructions will be displayed and the user will be able to open the file.&quot;Run By SmartScreen&quot; can alert/block in this way over 250 file types (unsafe file types), the rest are allowed to open without any alert (safe file types).</blockquote>

[QUOTE="Andy Ful, post: 839475, member: 32260"] Ha, ha. Yes, the correct name is "Standard User".:giggle: Both "Run As SmartScreen" and "Run By SmartScreen" cannot automatically elevate privileges. "Run As SmartScreen" can only allow the user to run the executable elevated via UAC prompt. The UAC prompt is caused by the elevation request. "Run [COLOR=rgb(184, 49, 47)][B]By [/B][/COLOR]SmartScreen" cannot force the executable to request the elevation of privileges, but the executable can still request it via the proper entry in the manifest. Yet, the file execution and this request will be blocked by SRP in the H_C default-deny setup (no UAC prompt). "Run [COLOR=rgb(184, 49, 47)][B]As[/B][/COLOR] SmartScreen" forces any executable to request elevation and this request will bypass SRP (the user will see the UAC prompt). In my opinion, there is another important difference between "Run By SmartScreen" and "Run As SmartScreen". The first is intended to open/run all files in unsafe locations. The user does not have to think about what file type is going to be opened. If it is a photo, then it will be opened without any alert. If it is a script, then it will be blocked with alert. If it is a native executable or MSI installer, then it will be blocked or allowed to run depending on the SmartScreen check. If it is an Office document, then the alert with some instructions will be displayed and the user will be able to open the file. "Run By SmartScreen" can alert/block in this way over 250 file types (unsafe file types), the rest are allowed to open without any alert (safe file types). [/QUOTE]

Verification