Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 885606" data-attributes="member: 32260">Why did you do it via registry tweak and GPO? You could do it via H_C. It is not good to mix the H_C rules with the same GPO rules.[ATTACH=full]241403[/ATTACH]The &lt;Block PowerShell Scripts&gt; option is set to ON in the Recommended Settings. The &lt;Block Windows Script Host&gt; option blocks wscript and cscript also for administrators.The H_C Recommended Settings already block wscript and cscript by SRP restrictions for processes running with standard privileges and this allows whitelisting. You can additionally block wscript and cscript by the policy &lt;Block Windows Script Host&gt;, but then you cannot whitelist any script.All these extensions (and many more) are already blocked by H_C. Did you use the option &lt;Designated File Types&gt; ?[ATTACH=full]241404[/ATTACH]The advantage of using H_C (SRP) for that is that you can whitelist a particular script or file with a blocked extension, if something requires it to work (some devices use scripts, .hta, etc.). When you unassociate the file extension, the whitelisting is not possible.</blockquote>

[QUOTE="Andy Ful, post: 885606, member: 32260"] Why did you do it via registry tweak and GPO? You could do it via H_C. It is not good to mix the H_C rules with the same GPO rules. [ATTACH type="full" alt="P_WSH.png"]241403[/ATTACH] The <Block PowerShell Scripts> option is set to ON in the Recommended Settings. The <Block Windows Script Host> option blocks wscript and cscript also for administrators. The H_C Recommended Settings already block wscript and cscript by SRP restrictions for processes running with standard privileges and this [B]allows whitelisting[/B]. You can additionally block wscript and cscript by the policy <Block Windows Script Host>, but then you [B]cannot whitelist any script[/B]. All these extensions (and many more) are already blocked by H_C. Did you use the option <Designated File Types> ? [ATTACH type="full" alt="DFT.png"]241404[/ATTACH] The advantage of using H_C (SRP) for that is that you can whitelist a particular script or file with a blocked extension, if something requires it to work (some devices use scripts, .hta, etc.). [B]When you unassociate the file extension, the whitelisting is not possible.[/B] [/QUOTE]

Verification