Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 852970" data-attributes="member: 82776">On request, here is the profile for Dangereous Filetype Restrictions. It is a little different from Avast_Hardened_mode and Windows10_MT_Windows_Security. Download file and rename it from Dangereous_Filetype_Restrictions.txt to Dangereous_Filetype_Restrictions.hdc[USER=32260]@Andy Ful[/USER]&nbsp; could you check it to confirm I implemented the intended use correctly:- block dangereous file extensions (with embbedded code) from running in user folders (allow in UAC protected folders)- block script interpreters from running as standard user (allow running as elevated administrator)- other settings are aimed to disable Windows features which average home users don&#039;t needNotes:<ol>
<li data-xf-list-type="ol">Validate Admin Code Signing is ON. Most mainstream software is signed, so this should not impact average PC users. When you have unsigned programs needing to run as Admin, disable &quot;Validate Admin CS&quot;.</li>
<li data-xf-list-type="ol">Most common script interpreters are blocked from running as standard user. Regular programs installed in UAC protected folders need to update elevated. In the unusual event when they would require power/command shell to run, those programs are allowed because the Software Restriction Policies are not applied to Administrators. When you are afraid to use this hardening fall back to using Windows10_MT_Windows_Security</li>
</ol>As the explanation mentions: run this profile with ConfigureDefender set to MAX (so all programs unknown are blocked by the cloud protection of Windows Defender) and Firewall Hardening blocking Office programs.</blockquote>

[QUOTE="Lenny_Fox, post: 852970, member: 82776"] On request, here is the profile for Dangereous Filetype Restrictions. It is a little different from Avast_Hardened_mode and Windows10_MT_Windows_Security. Download file and rename it from Dangereous_Filetype_Restrictions.txt to Dangereous_Filetype_Restrictions.hdc [USER=32260]@Andy Ful[/USER] could you check it to confirm I implemented the intended use correctly: - block dangereous file extensions (with embbedded code) from running in user folders (allow in UAC protected folders) - block script interpreters from running as standard user (allow running as elevated administrator) - other settings are aimed to disable Windows features which average home users don't need Notes: [LIST=1] [*]Validate Admin Code Signing is ON. Most mainstream software is signed, so this should not impact average PC users. When you have unsigned programs needing to run as Admin, disable "Validate Admin CS". [*]Most common script interpreters are blocked from running as standard user. Regular programs installed in UAC protected folders need to update elevated. In the unusual event when they would require power/command shell to run, those programs are allowed because the Software Restriction Policies are not applied to Administrators. When you are afraid to use this hardening fall back to using Windows10_MT_Windows_Security [/LIST] As the explanation mentions: run this profile with ConfigureDefender set to MAX (so all programs unknown are blocked by the cloud protection of Windows Defender) and Firewall Hardening blocking Office programs. [/QUOTE]

Verification