Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1060132" data-attributes="member: 32260">The current WDAC + ISG policy works exceptionally well when the users:<ol>
<li data-xf-list-type="ol">Use Windows native applications, Microsoft signed, or Microsoft Store applications.</li>
<li data-xf-list-type="ol">Install new applications with standalone application installers downloaded via web browsers.</li>
<li data-xf-list-type="ol">Choose standard installation locations.</li>
</ol>In the above scenario, most users will not see WDAC working. Why?<ul>
<li data-xf-list-type="ul">The applications from point 1 are allowed by digital certificates.</li>
<li data-xf-list-type="ul">The applications from point 2 trigger the SmartScreen check. If SmartScreen accepts the installer or the user chooses to bypass the SmartScreen alert, then the installation is allowed (just like without WDAC).</li>
<li data-xf-list-type="ul">The software auto-updates will work without problems due to whitelisted standard installation locations.</li>
</ul>The standard installation locations are not writable (with standard rights) or hidden in Explorer, so users will not use those locations to open/run executables.Finally, if the user is fooled to open something malicious (EXE or MSI file) without a SmartScreen check, then it is still checked by ISG and blocked.There is one thing that users must respect = SMARTSCREEN.If the user is a happy clicker, then WHHLight offers the option &lt; SmartScreen Block &gt; = ON.It will prevent the user from bypassing the SmartScreen alert.</blockquote>

[QUOTE="Andy Ful, post: 1060132, member: 32260"] The current WDAC + ISG policy works exceptionally well when the users: [LIST=1] [*]Use Windows native applications, Microsoft signed, or Microsoft Store applications. [*]Install new applications with standalone application installers downloaded via web browsers. [*]Choose standard installation locations. [/LIST] [B][COLOR=rgb(0, 168, 133)]In the above scenario, most users will not see WDAC working. [/COLOR]Why?[/B] [LIST] [*]The applications from point 1 are allowed by digital certificates. [*]The applications from point 2 trigger the SmartScreen check. If SmartScreen accepts the installer or the user chooses to bypass the SmartScreen alert, then the installation is allowed (just like without WDAC). [*]The software auto-updates will work without problems due to whitelisted standard installation locations. [/LIST] The standard installation locations are not writable (with standard rights) or hidden in Explorer, so users will not use those locations to open/run executables. Finally, if the user is fooled to open something malicious (EXE or MSI file) without a SmartScreen check, then it is still checked by ISG and blocked. [COLOR=rgb(184, 49, 47)][B]There is one thing that users must respect = SMARTSCREEN.[/B][/COLOR] If the user is a happy clicker, then WHHLight offers the option [B][COLOR=rgb(0, 168, 133)]< SmartScreen Block > = ON.[/COLOR][/B] It will prevent the user from bypassing the SmartScreen alert. [/QUOTE]

Verification