Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 971007" data-attributes="member: 32260">The H_C Recommended settings on Windows 8+ are based on the below main ideas:<ol>
<li data-xf-list-type="ol">Execution restrictions (default-deny). 
All paths directly accessible by users from the Desktop, Explorer, Email clients, Archiver applications, and web browsers should be restricted. So, casual users can hardly infect their computers by downloading/running something malicious.</li>
<li data-xf-list-type="ol">Forced SmartScreen (safe installations/updates) 
The restrictions from point 1 can be bypassed by the user, via the Explorer right-click menu option: InstallBySmartScreen. So, the user can safely install/update applications when executing EXE or MSI standalone installers. These installers are always checked by SmartScreen Application Reputation, even for files that normally are ignored by SmartScreen.</li>
<li data-xf-list-type="ol">Some additional Windows policies are applied like blocking remote features and restricting Adobe Reader and MS Office.</li>
</ol>From point 2 it follows that the User AppData and ProgramData folders have to be slightly less restricted for EXE and MSI files. But, these folders are normally inaccessible to the users (not visible in Explorer), so point 1 still holds.The H_C user can apply even more restrictive setting profiles if it is necessary for some reason. But, on the well patched Windows with well patched software, the Recommended Settings are optimal when both usability and security are taken into account.</blockquote>

[QUOTE="Andy Ful, post: 971007, member: 32260"] The H_C Recommended settings on Windows 8+ are based on the below main ideas: [LIST=1] [*]Execution restrictions (default-deny). All paths directly accessible by users from the Desktop, Explorer, Email clients, Archiver applications, and web browsers should be restricted. So, casual users can hardly infect their computers by downloading/running something malicious. [*]Forced SmartScreen (safe installations/updates) The restrictions from point 1 can be bypassed by the user, via the Explorer right-click menu option: InstallBySmartScreen. So, the user can safely install/update applications when executing EXE or MSI standalone installers. These installers are always checked by SmartScreen Application Reputation, even for files that normally are ignored by SmartScreen. [*]Some additional Windows policies are applied like blocking remote features and restricting Adobe Reader and MS Office. [/LIST] From point 2 it follows that the User AppData and ProgramData folders have to be slightly less restricted for EXE and MSI files. But, these folders are normally inaccessible to the users (not visible in Explorer), so point 1 still holds. The H_C user can apply even more restrictive setting profiles if it is necessary for some reason. But, on the well patched Windows with well patched software, the Recommended Settings are optimal when both usability and security are taken into account. [/QUOTE]

Verification