Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 956185" data-attributes="member: 32260">Post updated.Advanced users can configure Windows to open PDF documents only in AppContainer, and only from selected folders on NTFS disk (Windows and Program Files folders are hardcoded by default). This can be done by using Wsudo tool (from Privexec) and Sumatra PDF.[URL unfurl=&quot;false&quot;]https://github.com/M2Team/Privexec/releases/tag/4.4.1[/URL][URL unfurl=&quot;true&quot;]https://www.sumatrapdfreader.org/download-free-pdf-viewer[/URL]<ol>
<li data-xf-list-type="ol">Download Sumatra PDF installer and install it in &quot;Program Files&quot; folder (use Options button to change the default installation path). Choose Sumatra PDF as a default application to open PDF files.</li>
<li data-xf-list-type="ol">Copy the wsudo.exe (part of Privexec tool) to the Sumtra installation folder (C:\Program Files\SumatraPDF).</li>
<li data-xf-list-type="ol">Edit the registry Default value under the key: 
HKEY_CLASSES_ROOT\Applications\SumatraPDF.exe\Shell\Open\Command 
and replace its data with a path to Wsudo which executes SumatraPDF. 
[CODE]&quot;C:\Program Files\SumatraPDF\wsudo.exe&quot; -u appcontainer &quot;C:\Program Files\SumatraPDF\SumatraPDF.exe&quot; &quot;%1&quot; %*[/CODE]</li>
<li data-xf-list-type="ol">Create the folder where you want to keep unsafe PDF files - I have chosen&nbsp; &quot;D:\MyUnsafeDocuments&quot;. Use Icacls to give the &quot;Modify&quot; access of the AppContainer SID to this folder: 
[CODE]icacls &quot;D:\MyUnsafeDocuments&quot; /grant *S-1-15-2-3622619446-392274758-2533929289-2204876399-3375125215-4247762128-2478433618:(OI)(CI)(M) /T[/CODE] 
The SID may differ on another computer (probably). See Edit2 for details.</li>
<li data-xf-list-type="ol">Right mouse click on any PDF file choose Open with &gt;&gt; Choose another application &gt;&gt; select Windows sudo utility and tick &quot;Always open files ....&quot;. This will make Wsudo+Sumatra the default application to open PDF files.</li>
</ol>Now, by clicking on the PDF file it will be opened only if located in D:\MyUnsafeDocuments, and always in AppContainer.Of course, it is possible to use right-click &quot;Open with&quot; option and choose another PDF viewer to open any PDF file from any location.Edit1.It seems that Wsudo AppContainer has built-in access to &quot;Windows&quot; and &quot;Program Files&quot; folders. I can open documents from there without applying Icacls.Edit2.The SID of AppContainer can be found by opening CMD or PowerShell console and executing any file via Wsudo, for example:[CODE]Path2Wsudo\wsudo.exe -u appcontainer notepad[/CODE]</blockquote>

[QUOTE="Andy Ful, post: 956185, member: 32260"] [B]Post updated.[/B] [COLOR=rgb(184, 49, 47)][B]Advanced users[/B][/COLOR] can configure Windows to open PDF documents only in AppContainer, and only from selected folders on [B]NTFS disk[/B] (Windows and Program Files folders are hardcoded by default). This can be done by using Wsudo tool (from Privexec) and Sumatra PDF. [URL unfurl="false"]https://github.com/M2Team/Privexec/releases/tag/4.4.1[/URL] [URL unfurl="true"]https://www.sumatrapdfreader.org/download-free-pdf-viewer[/URL] [LIST=1] [*]Download Sumatra PDF installer and install it in "Program Files" folder (use Options button to change the default installation path). Choose Sumatra PDF as a default application to open PDF files. [*]Copy the wsudo.exe (part of Privexec tool) to the Sumtra installation folder (C:\Program Files\SumatraPDF). [*]Edit the registry [COLOR=rgb(41, 105, 176)]Default[/COLOR] value under the key: [COLOR=rgb(41, 105, 176)]HKEY_CLASSES_ROOT\Applications\SumatraPDF.exe\Shell\Open\Command[/COLOR] and replace its [COLOR=rgb(41, 105, 176)]data[/COLOR] with a path to Wsudo which executes SumatraPDF. [CODE]"C:\Program Files\SumatraPDF\wsudo.exe" -u appcontainer "C:\Program Files\SumatraPDF\SumatraPDF.exe" "%1" %*[/CODE] [*]Create the folder where you want to keep unsafe PDF files - I have chosen "D:\MyUnsafeDocuments". Use Icacls to give the "Modify" access of the AppContainer SID to this folder: [CODE]icacls "D:\MyUnsafeDocuments" /grant *S-1-15-2-3622619446-392274758-2533929289-2204876399-3375125215-4247762128-2478433618:(OI)(CI)(M) /T[/CODE] The SID may differ on another computer (probably). See Edit2 for details. [*]Right mouse click on any PDF file choose [COLOR=rgb(0, 168, 133)]Open with >> Choose another application >> [/COLOR]select[COLOR=rgb(0, 168, 133)] Windows sudo utility[/COLOR] and tick [COLOR=rgb(0, 168, 133)]"Always open files ...."[/COLOR]. This will make Wsudo+Sumatra the default application to open PDF files. [/LIST] Now, by clicking on the PDF file it will be opened only if located in D:\MyUnsafeDocuments, and always in AppContainer. Of course, it is possible to use right-click "Open with" option and choose another PDF viewer to open any PDF file from any location. Edit1. It seems that Wsudo AppContainer has built-in access to "Windows" and "Program Files" folders. I can open documents from there without applying Icacls. Edit2. The SID of AppContainer can be found by opening CMD or PowerShell console and executing any file via Wsudo, for example: [CODE]Path2Wsudo\wsudo.exe -u appcontainer notepad[/CODE] [/QUOTE]

Verification