Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1056078" data-attributes="member: 32260">No. It will be blocked, except for whitelisted folders.When the user runs the EXE file, WDAC ISG does not use SmartScreen for all files, but only for some of them (files with MOTW). The &quot;Run By SmartScreen&quot; always uses SmartScreen.For example, if you run the file from the (FAT32) USB drive, then WDAC ISG will not use SmartScreen but AI (more false positives). If you do the same in WHHLight (WDAC ON), you must use &quot;Run By SmartScreen&quot; and the file will be checked by SmartScreen.SAC works differently - it can produce fewer false positives than SmartScreen.Yes, I noticed this 7 years ago. That is why I implemented &quot;Install By SmartScreen&quot; and &quot;Run By SmartScreen&quot; in my applications. They automatically add the MOTW to&nbsp; EXE, MSI, and some other file types. In WHHLight (WDAC ON) the user is forced to run files from not-whitelisted locations via &quot;Run By SmartScreen&quot;. The software auto-updates and exploits will run EXE files without &quot;Run By SmartScreen&quot; and will be blocked (except for whitelisted folders).</blockquote>

[QUOTE="Andy Ful, post: 1056078, member: 32260"] No. It will be blocked, except for whitelisted folders. When the user runs the EXE file, WDAC ISG does not use SmartScreen for all files, but only for some of them (files with MOTW). The "Run By SmartScreen" always uses SmartScreen. For example, if you run the file from the (FAT32) USB drive, then WDAC ISG will not use SmartScreen but AI (more false positives). If you do the same in WHHLight (WDAC ON), you must use "Run By SmartScreen" and the file will be checked by SmartScreen. SAC works differently - it can produce fewer false positives than SmartScreen. Yes, I noticed this 7 years ago. That is why I implemented "Install By SmartScreen" and "Run By SmartScreen" in my applications. They automatically add the MOTW to EXE, MSI, and some other file types. In WHHLight (WDAC ON) the user is forced to run files from not-whitelisted locations via "Run By SmartScreen". The software auto-updates and exploits will run EXE files without "Run By SmartScreen" and will be blocked (except for whitelisted folders). [/QUOTE]

Verification