Reply to thread

Message

<blockquote data-quote="ForgottenSeer 107474" data-source="post: 1084324">Both WDAC-ISG and SRP allow Windows, Program Files, Program Files (x86) and ProgramData\\Microsoft\Windows Defender\Platform. SRP blocks the file extensions set by H_C for standard users with your extra Windows &#039;UAC hole&#039;&nbsp; folders protection plus your exe/msi/tmp blocks for LocalLow and zip extraction folders +your H_C sponsor blocks and allows exceptions for lnk from the safe locations you specified in H_C.&nbsp; I am using Outlook and only Windows build-in zip, so don&#039;t need the exe/msi/tmp blocks of the other archivers and email programs. I added (exe/msi/tmp) deny for my public and download folder plus Documents/Images/Music/Video folders on D (data) partiion. I have been running your H_C config in SWH-mode plus sponsor blocks for standard with CD on MAX with all ASR rules enabled since I bought my previous laptop in 2021. Only when HP support assistant tells me it has new drivers, I have to enable CMD through reg-file temporarely.I know you often post that SWH compared to SWH + blocking LoLbins is onlly marginally better protection. When I disable CMD the SRP block warning seems to overrule the CDM disabled and no access allowed messages. For my wife it is clearer. When she would encounter an SRP block she would know the admin set policies to block it, while the others may confuse here that something is malfunctioning. So for me it is more a useability tweak than a security tweak to add LoLBin blocks.</blockquote>

[QUOTE="ForgottenSeer 107474, post: 1084324"] Both WDAC-ISG and SRP allow Windows, Program Files, Program Files (x86) and ProgramData\\Microsoft\Windows Defender\Platform. SRP blocks the file extensions set by H_C for standard users with your extra Windows 'UAC hole' folders protection plus your exe/msi/tmp blocks for LocalLow and zip extraction folders +your H_C sponsor blocks and allows exceptions for lnk from the safe locations you specified in H_C. I am using Outlook and only Windows build-in zip, so don't need the exe/msi/tmp blocks of the other archivers and email programs. I added (exe/msi/tmp) deny for my public and download folder plus Documents/Images/Music/Video folders on D (data) partiion. I have been running your H_C config in SWH-mode plus sponsor blocks for standard with CD on MAX with all ASR rules enabled since I bought my previous laptop in 2021. Only when HP support assistant tells me it has new drivers, I have to enable CMD through reg-file temporarely. I know you often post that SWH compared to SWH + blocking LoLbins is onlly marginally better protection. When I disable CMD the SRP block warning seems to overrule the CDM disabled and no access allowed messages. For my wife it is clearer. When she would encounter an SRP block she would know the admin set policies to block it, while the others may confuse here that something is malfunctioning. So for me it is more a useability tweak than a security tweak to add LoLBin blocks. [/QUOTE]

Verification