Reply to thread

Message

<blockquote data-quote="Marana" data-source="post: 1117619" data-attributes="member: 69370">Regarding 1): Hard_Configurator is not compatible with WHHL that has a user-friendly user interface to WDAC. I was hoping to find a way to be able to operate easily with a default deny SRP policy along with the modern security mechanisms (WDAC, ISG and IAC). And as you mentioned, H_C does not support restricting DLLs either. On the other hand, I seem to represent a very small minority, so I understand your point if you are not willing to implement that. I know from personal experience that it is not possible to make everyone happy...Regarding 2): In the (hopefully not so long <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />) mean time, would it be possible to reveal at least, what Microsoft App Control for Business example base policies are the WHHL .cip policy files based on (if any), and what modifications have you implemented in them?EDIT: One example to explain my interest in default deny style protection: I volunteer in an NGO which handles privacy sensitive information, and a typical use scenario includes days when a laptop is first connected to internet and e.g. new email messages are downloaded. Then later, when network connections are not available, the user may read the earlier downloaded mail messages and open some attachments. Some information may also be transferred to/from the laptop via USB memory sticks when offline. Under these circumstances, cloud-based protections are not available, but the default deny policies do still work well.</blockquote>

[QUOTE="Marana, post: 1117619, member: 69370"] Regarding 1): Hard_Configurator is not compatible with WHHL that has a user-friendly user interface to WDAC. I was hoping to find a way to be able to operate easily with a default deny SRP policy along with the modern security mechanisms (WDAC, ISG and IAC). And as you mentioned, H_C does not support restricting DLLs either. On the other hand, I seem to represent a very small minority, so I understand your point if you are not willing to implement that. I know from personal experience that it is not possible to make everyone happy... Regarding 2): In the (hopefully not so long ;)) mean time, would it be possible to reveal at least, what Microsoft App Control for Business example base policies are the WHHL .cip policy files based on (if any), and what modifications have you implemented in them? [B]EDIT[/B]: One example to explain my interest in default deny style protection: I volunteer in an NGO which handles privacy sensitive information, and a typical use scenario includes days when a laptop is first connected to internet and e.g. new email messages are downloaded. Then later, when network connections are not available, the user may read the earlier downloaded mail messages and open some attachments. Some information may also be transferred to/from the laptop via USB memory sticks when offline. Under these circumstances, cloud-based protections are not available, but the default deny policies do still work well. [/QUOTE]

Verification