Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[Andy Ful]

Unfortunately I have Windows reinstalled, as enabling WDAC once keeps antimalware executable running even after installing third party AV, even after disabling WDAC.
This is not the case when SAC is disabled.

The events blocked by SAC cannot be whitelisted by users (must be submitted to Microsoft). It uses its own WDAC policies.

 

[Parkinsond]

The events blocked by SAC cannot be whitelisted by users (must be submitted to Microsoft). It uses its own WDAC policies.

I know; the block of two dll files of Yandex was by WDAC through WHHL; it did not respect the exclusion by path and kept blocking the files.
SAC will do the same, but without the feature of exclusion.

 

[Andy Ful]

I know; the block of two dll files of Yandex was by WDAC through WHHL; it did not respect the exclusion by path and kept blocking the files.
SAC will do the same, but without the feature of exclusion.

It is possible in WHHLight when the whitelisted binary is on the Microsoft Recommended BlockList.
Please let me know if you encounter a similar block. It would be interesting to look at it more closely.

 

[Parkinsond]

It is possible in WHHLight when the whitelisted binary is on the Microsoft Recommended BlockList.
Please let me know if you encounter a similar block. It would be interesting to look at it more closely.

This is not unique to Yandex browser; even whitelisting Symantec endpoint protection, Avast, AVG, Bitdefender, and Kaspersky did not save some dll files from being blocked by WDAC, inspite of not blocking the apps to launch and work.

 

[Andy Ful]

This is not unique to Yandex browser; even whitelisting Symantec endpoint protection, Avast, AVG, Bitdefender, and Kaspersky did not save some dll files from being blocked by WDAC, inspite of not blocking the apps to launch and work.

Yes. I noticed this in the example of Avast (DLL related to AMSI).

 

[ProblematicPions]

Should I add SystemTemp to my WDAC Whitelist when seeing this? Maybe not as it's only Dropbox using this temp folder and getting blocked.

Event[0]:
Event Id = 3077
Local Time: 2026/08/23 18:36:00
Attempted Path = C:\Windows\SystemTemp\dropbox_Unpacker_BeginUnzipping2920_2144705447\DropboxClientInstaller.exe
Parent Process = C:\Program Files\Dropbox\DropboxUpdater\123.0.6299.144\updater.exe
PolicyName = UserSpace Lock
UserWriteable = true

I usually update Dropbox by manually installing new versions.

 

[Andy Ful]

Should I add SystemTemp to my WDAC Whitelist when seeing this?

Normally, opening this folder requires Administrative rights. Folders that require Administrative rights are allowed by WHHLight (no need for whitelisting).
Here is what probably happened (when you tried to open it via Explorer in the past):

If you pressed the Continue button, the Security Properties of this folder were permanently changed, and it can be accessed without Administrative rights. Such folders are blocked by WDAC in WHHLight.
Advanced users can restore the default Security settings of this folder by deleting the user account entry from the "Group or user names" section and allowing only SYSTEM and Administrators (caution required when changing Security settings):

 

[ProblematicPions]

Interesting. Thanks. Fixed.

So actually, my curiosity changes the Security Properties of the folder and then the folder, simply said, 'becomes' modified and therefore is blocked by WDAC.

Makes sense

Also, it didn't happen on my mother's PC and that's of course because I don't use hers in any way like I use my own.