Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 560672" data-attributes="member: 32260">It is interesting. Your system is somewhat more restricted than mine for LNK or EXE files.I figured out how to minimize LNK execution problem in my setup. Here are all path rules in my SRP configuration:DISALLOWED*.lnkUNRESTRICTED%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%%LOCALAPPDATA%\Microsoft\Windows\WinX\Group1\*.lnk%LOCALAPPDATA%\Microsoft\Windows\WinX\Group2\*.lnk%LOCALAPPDATA%\Microsoft\Windows\WinX\Group3\*.lnk%USERPROFILE%\Desktop\*.lnkC:\ProgramData\Microsoft\Windows\Start Menu\*.lnkC:\ProgramData\Microsoft\Windows\Start Menu\Programs\*.lnkC:\ProgramData\Microsoft\Windows\Start Menu\Programs\*\*.lnkI simply disallowed LNK files globally, and then whitelisted them in some folders for using &#039;Power Menu&#039;, &#039;Desktop&#039;, and &#039;Start Menu&#039; shortcuts. Yet, whitelisting LNK locations has the side effect, that now I can run all scripts (BAT, CMD, JS, JSE, PS1, VBS, VBE, WSF, HTA), and configuration files (CPL, MSC, REG) in the User Space, by the shortcut in whitelisted location. This loophole can be made smaller if CMD, WSH, and PowerShell scripts are blocked by the reg tweak.Above tweaks works in the same way on my 2 computers - Win 10 Pro (SRP configured by Secpol) and Win 7 Home (configured by reg hack).I am curious how the LNK problem looks like on other computers.</blockquote>

[QUOTE="Andy Ful, post: 560672, member: 32260"] It is interesting. Your system is somewhat more restricted than mine for LNK or EXE files. I figured out how to minimize LNK execution problem in my setup. Here are all path rules in my SRP configuration: DISALLOWED *.lnk UNRESTRICTED %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)% %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% %LOCALAPPDATA%\Microsoft\Windows\WinX\Group1\*.lnk %LOCALAPPDATA%\Microsoft\Windows\WinX\Group2\*.lnk %LOCALAPPDATA%\Microsoft\Windows\WinX\Group3\*.lnk %USERPROFILE%\Desktop\*.lnk C:\ProgramData\Microsoft\Windows\Start Menu\*.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*\*.lnk I simply disallowed LNK files globally, and then whitelisted them in some folders for using 'Power Menu', 'Desktop', and 'Start Menu' shortcuts. Yet, whitelisting LNK locations has the side effect, that now I can run all scripts (BAT, CMD, JS, JSE, PS1, VBS, VBE, WSF, HTA), and configuration files (CPL, MSC, REG) in the User Space, by the shortcut in whitelisted location. This loophole can be made smaller if CMD, WSH, and PowerShell scripts are blocked by the reg tweak. Above tweaks works in the same way on my 2 computers - Win 10 Pro (SRP configured by Secpol) and Win 7 Home (configured by reg hack). I am curious how the LNK problem looks like on other computers. [/QUOTE]

Verification