Deprecated Windows 11 22H2 no longer supports Software Restriction Policies (SRP)

[Andy Ful]

I am also curious. I thought changing environment variables normally requires admin rights (when @Andy Ful is taling about __PSLockDownPolicy)

I cannot post anything about this bypass on MT, but it is well-known to professional administrators (and hackers).
The __PSLockDownPolicy should not be applied in Enterprises. It is efficient at home because the attackers do not expect it and do not bother to check it.

 

[ForgottenSeer 98186]

I am also curious. I thought changing environment variables normally requires admin rights (when @Andy Ful is taling about __PSLockDownPolicy)

It is public infos. If interested, send me a PM and I will provide you multiple links to researchers, pentest and GItHub sources. Some of it is tedious, long reading. Well worth it if you want the knowledge.

A 10 second Google search using the correct keywords will return a bunch of links.

 

[Andy Ful]

I asked ChatGPT (via Bing): "Can Software Restriction Policies work on Windows 11?"
Here is the answer:

The suggested 5 links are generally about SRP. Only one of them suggests the solution (link to this thread on MT).

 

[ForgottenSeer 97327]

Okay, there is a downside on keeping your system hardening on 2019 level: @Oerlink and @Andy Ful I found the bypass on infosec, it is to simple for words

 

[Andy Ful]

I tested the SRP with my correction:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000000

In the test, the SAC was (re)set several times between all available modes ON, OFF, and Evaluation. This can be done by using the registry tweaks (Windows restart is required):

1. ON mode:
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
   "VerifiedAndReputablePolicyState"=dword:00000001
2. OFF mode:
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
   "VerifiedAndReputablePolicyState"=dword:00000000
3. Evaluation mode:
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
   "VerifiedAndReputablePolicyState"=dword:00000002

In all instances, both SRP and SAC worked as intended.