Deprecated Windows 11 22H2 no longer supports Software Restriction Policies (SRP)

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,186
I am also curious. I thought changing environment variables normally requires admin rights (when @Andy Ful is taling about __PSLockDownPolicy)
I cannot post anything about this bypass on MT, but it is well-known to professional administrators (and hackers).
The __PSLockDownPolicy should not be applied in Enterprises. It is efficient at home because the attackers do not expect it and do not bother to check it.:)
 
Last edited:
F

ForgottenSeer 98186

I am also curious. I thought changing environment variables normally requires admin rights (when @Andy Ful is taling about __PSLockDownPolicy)
It is public infos. If interested, send me a PM and I will provide you multiple links to researchers, pentest and GItHub sources. Some of it is tedious, long reading. Well worth it if you want the knowledge.

A 10 second Google search using the correct keywords will return a bunch of links.
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,186
I asked ChatGPT (via Bing): "Can Software Restriction Policies work on Windows 11?"
Here is the answer:
1677672411451.png


The suggested 5 links are generally about SRP. Only one of them suggests the solution (link to this thread on MT). :)
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,186
I tested the SRP with my correction:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000000

In the test, the SAC was (re)set several times between all available modes ON, OFF, and Evaluation. This can be done by using the registry tweaks (Windows restart is required):
  1. ON mode:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
    "VerifiedAndReputablePolicyState"=dword:00000001
  2. OFF mode:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
    "VerifiedAndReputablePolicyState"=dword:00000000
  3. Evaluation mode:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
    "VerifiedAndReputablePolicyState"=dword:00000002
In all instances, both SRP and SAC worked as intended.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top