Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[Andy Ful]

Unfortunately I have Windows reinstalled, as enabling WDAC once keeps antimalware executable running even after installing third party AV, even after disabling WDAC.
This is not the case when SAC is disabled.

The events blocked by SAC cannot be whitelisted by users (must be submitted to Microsoft). It uses its own WDAC policies.

 

[Parkinsond]

The events blocked by SAC cannot be whitelisted by users (must be submitted to Microsoft). It uses its own WDAC policies.

I know; the block of two dll files of Yandex was by WDAC through WHHL; it did not respect the exclusion by path and kept blocking the files.
SAC will do the same, but without the feature of exclusion.

 

[Andy Ful]

I know; the block of two dll files of Yandex was by WDAC through WHHL; it did not respect the exclusion by path and kept blocking the files.
SAC will do the same, but without the feature of exclusion.

It is possible in WHHLight when the whitelisted binary is on the Microsoft Recommended BlockList.
Please let me know if you encounter a similar block. It would be interesting to look at it more closely.

 

[Parkinsond]

It is possible in WHHLight when the whitelisted binary is on the Microsoft Recommended BlockList.
Please let me know if you encounter a similar block. It would be interesting to look at it more closely.

This is not unique to Yandex browser; even whitelisting Symantec endpoint protection, Avast, AVG, Bitdefender, and Kaspersky did not save some dll files from being blocked by WDAC, inspite of not blocking the apps to launch and work.

 

[Andy Ful]

This is not unique to Yandex browser; even whitelisting Symantec endpoint protection, Avast, AVG, Bitdefender, and Kaspersky did not save some dll files from being blocked by WDAC, inspite of not blocking the apps to launch and work.

Yes. I noticed this in the example of Avast (DLL related to AMSI).