Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1026366">Microsoft provides everything that a (inclined, initiated, persevering) user needs to protect their system. No 3rd party software is ever needed. We can call the effort required to harden Windows a &quot;usability&quot; issue, but Microsoft does not see it that way. Microsoft&#039;s official position has always been that Windows is meant to be managed, and its administration is meant for IT pros. Its learn documentation pages are not written for the home user; they are written for IT professionals. The Home version is a &quot;trickle-down&quot; (more like a &#039;hand-me-down&#039;) and userland species get what Microsoft chooses to give them as far as security. If nobody noticed, security on the Home version is most definitely not a priority to Microsoft. Pretty desktop icons are.This bit about the &quot;remnant&quot; or &quot;bogus&quot; AppLocker keys being &quot;left behind&quot; in Windows 11 22H2 might or might not be accurate. There is no indication whatsoever that Microsoft created those keys intentionally. However, as Kanthak states (paraphrase): &quot;the key values are incorrect and non-sensical in that there are no AppLocker rules are connected to them&quot;. Looking at the evidence, I am inclined to think it is just sloppy work - as opposed to purposeful - on the part of whomever at Microsoft.I would think someone that wants to enable SRP lockdown mode would not be so concerned about SAC working alongside SRP. SAC is for those &quot;users who want to use stuff&quot; and need a software to make security decisions for them. Oh, SAC and SRP working together can arguably be called a &quot;nice-to-have,&quot; except for the security geek it is best if the home user relies upon default-allow (white-listing) SAC.A user can add the Microsoft recommended block-list (or the entire LOLBin list if they choose) to Microsoft Exploit Guard and set a rule to block Win32 syscalls and then set program installs to Microsoft Store only - and they have an operating system default-deny configuration (S mode) that was the most malware-free in the company&#039;s history. The great security supplied by S Mode, a extremely low infection rate, are the very reasons why Microsoft developed SAC and is currently pushing that initiative.SAC can do a lot of great things for userland, but it remains to be seen. Afterall, Microsoft is trying to cater to &quot;users that want to use stuff,&quot; so user whims and profitability come first. (Think about it, what does Microsoft care if some gamer downloads a game cheat that turns out to be LAN-spreading ransomware and they infect all the home group connected devices in the household? lol, Microsoft offers $75 per device malware removal service= clean install Windows.) Microsoft will get a lot of user and developer complaints about SAC (which, at this point, is absolutely guaranteed) and then it will silently place SAC into maintenance.</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1026366"] Microsoft provides everything that a (inclined, initiated, persevering) user needs to protect their system. No 3rd party software is ever needed. We can call the effort required to harden Windows a "usability" issue, but Microsoft does not see it that way. Microsoft's official position has always been that Windows is meant to be managed, and its administration is meant for IT pros. Its learn documentation pages are not written for the home user; they are written for IT professionals. The Home version is a "trickle-down" (more like a 'hand-me-down') and userland species get what Microsoft chooses to give them as far as security. If nobody noticed, security on the Home version is most definitely not a priority to Microsoft. Pretty desktop icons are. This bit about the "remnant" or "bogus" AppLocker keys being "left behind" in Windows 11 22H2 might or might not be accurate. There is no indication whatsoever that Microsoft created those keys intentionally. However, as Kanthak states (paraphrase): "the key values are incorrect and non-sensical in that there are no AppLocker rules are connected to them". Looking at the evidence, I am inclined to think it is just sloppy work - as opposed to purposeful - on the part of whomever at Microsoft. I would think someone that wants to enable SRP lockdown mode would not be so concerned about SAC working alongside SRP. SAC is for those "users who want to use stuff" and need a software to make security decisions for them. Oh, SAC and SRP working together can arguably be called a "nice-to-have," except for the security geek it is best if the home user relies upon default-allow (white-listing) SAC. A user can add the Microsoft recommended block-list (or the entire LOLBin list if they choose) to Microsoft Exploit Guard and set a rule to block Win32 syscalls and then set program installs to Microsoft Store only - and they have an operating system default-deny configuration (S mode) that was the most malware-free in the company's history. The great security supplied by S Mode, a extremely low infection rate, are the very reasons why Microsoft developed SAC and is currently pushing that initiative. SAC can do a lot of great things for userland, but it remains to be seen. Afterall, Microsoft is trying to cater to "users that want to use stuff," so user whims and profitability come first. (Think about it, what does Microsoft care if some gamer downloads a game cheat that turns out to be LAN-spreading ransomware and they infect all the home group connected devices in the household? lol, Microsoft offers $75 per device malware removal service= clean install Windows.) Microsoft will get a lot of user and developer complaints about SAC (which, at this point, is absolutely guaranteed) and then it will silently place SAC into maintenance. [/QUOTE]

Verification