Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1061050" data-attributes="member: 32260">The FirewallHardening child process is blocked in the &quot;C:\Windows\Temp&quot; folder, because this folder on your computer is writable with standard rights.<s>Normally, it is not writable and applications can run from &quot;C:\Windows\Temp&quot; with WHHLight restrictions.</s>In your case there are two solutions:<ol>
<li data-xf-list-type="ol">Add the path &quot;C:\Windows\Temp&quot; to the WDAC Whitelist.</li>
<li data-xf-list-type="ol">Switch OFF the WDAC temporarily (recommended if other applications are not blocked in &quot;C:\Windows\Temp&quot;).</li>
</ol>Edit1.The untypical ACL restrictions for &quot;C:\Windows\Temp&quot; can happen when you have forced access to the &quot;c:\Windows\Temp&quot; folder <s>from Standard User Account.</s><s></s>Edit2More info can be found in the post:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/testing-windows-hybrid-hardening-new-hardening-application.125082/post-1061492[/URL]</blockquote>

[QUOTE="Andy Ful, post: 1061050, member: 32260"] The FirewallHardening child process is blocked in the "C:\Windows\Temp" folder, because this folder on your computer is writable with standard rights. [S]Normally, it is not writable and applications can run from "C:\Windows\Temp" with WHHLight restrictions.[/S] In your case there are two solutions: [LIST=1] [*]Add the path "C:\Windows\Temp" to the WDAC Whitelist. [*]Switch OFF the WDAC temporarily (recommended if other applications are not blocked in "C:\Windows\Temp"). [/LIST] Edit1. The untypical ACL restrictions for "C:\Windows\Temp" can happen when you have forced access to the "c:\Windows\Temp" folder [S]from Standard User Account. [/S] Edit2 More info can be found in the post: [URL unfurl="true"]https://malwaretips.com/threads/testing-windows-hybrid-hardening-new-hardening-application.125082/post-1061492[/URL] [/QUOTE]

Verification