Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 887122" data-attributes="member: 32260">The &#039;All files&#039; enforcement can be still used, by an advanced user (after making the setup via the H_C and closing H_C) by a simple reg tweak:[HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers]&quot;TransparentEnabled&quot;= dword:00000002I am sorry, but I cannot keep it in H_C, because it can be a source of the hidden incompatibilities that are hard to find out. For example, I noticed that blocking DLLs feature is incompatible with some AVs (like Avast) and some Microsoft applications (like OneDrive Personal Vault). This does not follow from blocking any particular DLL, so it cannot be solved by whitelisting DLLs. Furthermore, the .NET DLLs and DLLs loaded by some other popular methods (like reflective DLL injection) cannot be blocked by SRP, so this feature is not as useful as in times of Windows Vista and can give the user a false sense of security. The user has to use something else (AppLocker, WD Application Control, etc.) to block DLLs or apply SRP setup which makes using malicious DLLs improbable.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 887122, member: 32260"] The 'All files' enforcement can be still used, by an advanced user (after making the setup via the H_C and closing H_C) by a simple reg tweak: [HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers] "TransparentEnabled"= dword:00000002 I am sorry, but I cannot keep it in H_C, because it can be a source of the hidden incompatibilities that are hard to find out. For example, I noticed that blocking DLLs feature is incompatible with some AVs (like Avast) and some Microsoft applications (like OneDrive Personal Vault). This does not follow from blocking any particular DLL, so it cannot be solved by whitelisting DLLs. Furthermore, the .NET DLLs and DLLs loaded by some other popular methods (like reflective DLL injection) cannot be blocked by SRP, so this feature is not as useful as in times of Windows Vista and can give the user a false sense of security. The user has to use something else (AppLocker, WD Application Control, etc.) to block DLLs or apply SRP setup which makes using malicious DLLs improbable.(y) [/QUOTE]

Verification