Hot Take KIS/KTS/KSCloud/KStandard/KPlus/KPremium - Implementing Protected Folders via Manage Resources (+ Default Deny Mode)

[harlan4096]

Of course, it's very restrictive hehe have You tried it?

 

[ItsReallyMe]

Of course, it's very restrictive hehe have You tried it?

yea I am using it for more than 2 months without any problem, I used it in interactive mode with "Ask User" rather than Deny, I couldn't find any software other than macrium reflect and kerish doctor,iobit asking to access it.

 

[harlan4096]

I see you have a huge bunch of overkill security products installed + in resident protection there

 

[ItsReallyMe]

I see you have a huge bunch of overkill security products installed + in resident protection there

yea i just installed them to test, i will uninstall them soon!

 

[ItsReallyMe]

Is it a must that we have to add protected folders under Personal data> User Files? Can we just add the protected folders just under Personal Data rather than Personal data> User Files?

 

[harlan4096]

Hum... probably there is no difference, and all will depend finally on the rules You set up...

 

[zkSnark]

@harlan4096 I configured KTS using the instructions in your first post, update post and Shukla44's post. But when starting my laptop, I am getting this popup error.

Though I am logged in as Administrator, I am denied permission to access "WindowsApps" folder. Tried in Safe Mode, I can access "WindowsApps" folder but cannot delete the folder "AppUP.Intel....".
I reverted to KTS default config and the popup error did not show. Is something wrong in my config?

 

[harlan4096]

Did You check if that app was moved to UnTrusted group in Application Control / Intrusion Prevention? If so, You can move to Trusted group, and it should fix the warning.

Maybe that file is not digitally signed or not very well-known in KSN yet…

 

[zkSnark]

Did You check if that app was moved to UnTrusted group in Application Control / Intrusion Prevention? If so, You can move to Trusted group, and it should fix the warning.

Maybe that file is not digitally signed or not very well-known in KSN yet…

This was the KTS log for that file

Today, 12/25/2022 6:40:05 AM Application Control was triggered IGCC IGCC.exe C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.4232.0_x64__8j3eq9eme6ctt 12560 RM-PC\RM Active user evtModify Allowed Allowed IGCCApp.db C:\Users\RM\AppData\Local\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt\LocalState Personal data

 

[harlan4096]

Can You show the KSN info (Details and Rules -> File in Application Control) for that exe?

This way, for example:

 

[zkSnark]

Can You show the KSN info (Details and Rules -> File in Application Control) for that exe?

This way, for example:

View attachment 271557

Here:

 

[harlan4096]

Move IGCCTray.exe to Trusted group (Error Verifying Signature).

Also, one of the IGCC files appears as not digitally signed (Missing)

 

[zkSnark]

Here:
View attachment 271558

This was in KTS default settings.
Below is when I config KTS with your settings. IGCC Tray is moved from Low Restricted to High Restricted.

 

[harlan4096]

Still, move manually IGCCTray (without file extension) to Trusted, probably a short-cut?

 

[zkSnark]

Move IGCCTray.exe to Trusted group (Error Verifying Signature).

Also, one of the IGCC files appears as not digitally signed (Missing)

Moved to Trusted, restarted PC and the popup error did not display. Thanks for the help.
Since Intel files are installed automatically, I don't know why 3 files are missing digital signature and only "IGCC" is digitally signed. Any suggestion how to get the digital signature for those files?

 

[harlan4096]

It's the developer probably who have to fix the issue, hehe...

 

[harlan4096]

A little trick to know when an application is moved to a Restricted group:

 

[zkSnark]

It's the developer probably who have to fix the issue, hehe...

Okay. So configuring KTS with your configs, is KTS enough for protection? Do I need other programs like VS, H_C, etc?

 

[harlan4096]

IMHO not needed...

 

[ItsReallyMe]

IMHO not needed...

Does KTS encrypt everything we type?