No, i'll do that. thanksIt should start on login.
Did you add Program Files/Program Files (x86) to unristricted?
Yes, but mainly concentrating on OPAlso add Windows folder.
Did you read all in this thread?
Can you explain my what this Hash check mean?
What is the difference between Path and Hash check?
Also, UTC/GMT times also affects hash generated by the software to harden the security. One time Password and Authenticator apps on phones is a good example.Here is a good explanation:
"A hash is a series of bytes with a fixed length that uniquely identifies a program or file. A hash value is generated by an algorithm that essentially creates a fingerprint of the file, making it nearly impossible for another program to have the same hash. If you create a hash rule and a user attempts to run a program affected by the rule, the system checks the hash value of the executable file and compares it with the hash value stored in the software restriction policy. If the two match, the policy settings will apply. Therefore, creating a hash rule for an application executable prevents the application from running if the hash value is not correct. Because the hash value is based on the file itself, the file will continue to function if you move it from one location to another. If the executable file is altered in any way, for example, if it is modified or replaced by a worm or virus, the hash rule in the software restriction policy prevents the file from running."
preparation for 70-410: Configure application restriction policies
File hashes are widely used to uniquely identify files, for example Virus Total shows file hashes in "Additional Information" bookmark.
In Windows 10, SRP uses MD5 and SHA-256 cryptographic algorithms to fingerprint the files whitelisted by hash. The second algorithm is pretty good.
The main difference (for whitelisting) between Hash and Path checking is simple. The first can recognize if the file has been changed by malware, the second unfortunately cannot.
EMET require manual whitelisting, if not some of your softs may be blocked depending the security setting you chose.
I observed delays by over 20 sec if EMET was running on Auto startup on HDD. On SSD, it doesn't matter.I just tested latest EMET version. It is still a bit buggy - and Microsoft set the EMET service start to Automatic (Delayed) ? It seems to be a little bit of a resource hog too...
Any examples, Mr. Umbra? So far, I've seen Java, IE, FF, Chrome, FB, Twitter apps in EMET list.EMET require manual whitelisting, if not some of your softs may be blocked depending the security setting you chose.
Shortcut will be where (deskotop, Program Files...)?
After a few months of using SRP, I realized that 'Basic User' security level is vulnerable to simple drive by attack in my computer. It is sufficient to drop malware EXE file and the shortcut to it, and then execute this shortcut. Other extensions are still protected.
Am I stupid or Microsoft is so clever?
Well that depends: Microsoft was so clever to protect the folders from which executables are allowed in basic user mode and they called it UAC. So for SRP to be bypassed by a drive by attack, you have to ignore both Smartscreen and UAC.After a few months of using SRP, I realized that 'Basic User' security level is vulnerable to simple drive by attack in my computer. It is sufficient to drop malware EXE file and the shortcut to it, and then execute this shortcut. Other extensions are still protected.
Am I stupid or Microsoft is so clever?