Reply to thread

Message

<blockquote data-quote="ForgottenSeer 92963" data-source="post: 965304">The basic user SRP changed from Vista to Windows7. On Windows7 running as basic user also was a deny in user folders. On Vista it was allowed to run in user space, but it blocked elevation (so every program which had a separate updater could run in a basic user container).&nbsp; That is did not run on Windows7 well anymore.Many SRP users (like me) liked Vista because it had Integrity Levels (like Windows 7) and basic user container (like XP). When Joanna Rutkowska (leading force behind Qubes OS) posted a blog about isolating with Integrity Levels and different user roles, many of us copied her idea to use separaten users for mail and internet programs. By using different users it was possible to run programs in a user rights - integrity level - data access control sandbox (e.g. the user which was used for the browser only had read access to all folders except download folder temporary folders used by the browser, it was even possible to block read access to System32 folder to prevent ring3 living of the land intrusion).I am using your software in stead of Group Policy (because it is much easier to use) so the detailed knowledge has eroded also in regard to Integrity Levels-SRP-AppLocker-Protected Processes stuf.</blockquote>

[QUOTE="ForgottenSeer 92963, post: 965304"] The basic user SRP changed from Vista to Windows7. On Windows7 running as basic user also was a deny in user folders. On Vista it was allowed to run in user space, but it blocked elevation (so every program which had a separate updater could run in a basic user container). That is did not run on Windows7 well anymore. Many SRP users (like me) liked Vista because it had Integrity Levels (like Windows 7) and basic user container (like XP). When Joanna Rutkowska (leading force behind Qubes OS) posted a blog about isolating with Integrity Levels and different user roles, many of us copied her idea to use separaten users for mail and internet programs. By using different users it was possible to run programs in a user rights - integrity level - data access control sandbox (e.g. the user which was used for the browser only had read access to all folders except download folder temporary folders used by the browser, it was even possible to block read access to System32 folder to prevent ring3 living of the land intrusion). I am using your software in stead of Group Policy (because it is much easier to use) so the detailed knowledge has eroded also in regard to Integrity Levels-SRP-AppLocker-Protected Processes stuf. [/QUOTE]

Verification