Guide | How To Windows Home/Pro owner? Use Software Restriction Policies!

[Windows_Security]

LS,

For people owning a Pro/Business/Ultimate/Enterprise version of their Windows OS and not using the group policy editor to increase security with build in features, here is a simple 10 step tutorial to enable SRP (works for all Windows OS-ses with UAC, so Vista and higher).

SRP stands for Software Restriction Policies. As the name says it can be used to restrict software on your PC. It has basically three modes. This introduction describes how to use Basic User, because Basic User requires little tweaking and still allows to update/install software using Run as Administrator (make sure to create a restore point or have image as backup)

Run as administrator
With these "Basic User default" SRP rules, when you try to run a program in user folders, it will be blocked. You can still update/install software by using the "Run as Administrator" right click context menu in Windows Explorer. Microsoft Installer Packages don't run with elevated (admin) rights by default. Luckily Symantec has provided a registry tweak for that: download MSI "Run as administrator" Context Menu for Vista | Symantec Connect (MsiRunAsAdmin.zip)

Extract the zip file and double click it.

Enabling SRP using Basic User as default level
Click on Windows Start button and choose "Run". Enter secpol.msc and enter. Secpol.msc launches the Local Security Policy management console and follow the instructions on the picture below. Restart your computer when ready and your done.

 

[Windows_Security]

Why use Basic User default level and why allow local Administrators?
All programs updating to Windows or Program Files folders must run elevated (UAC). When you apply these rules except for Admin, these SRP rules don't interfere with regular program and OS updates. It is set and forget.


Programs in user space are blocked.
See link explains with picures how to add block rules. This link (step 9) on how to add an allow rule (Unrestricted security level). This setup does not mimic an anti-executable default deny setup, just prevents shoot in the foot errors and sneaky drive by infections. You determine what survives reboot by using "Run As Administrator"

Defending user space autoruns
Windows allows a few autorun locations in user space. This little nifty freeware program warns you when software wants to survive reboot by using user space autoruns: KC Softwares Startup Sentinel (thx Kyle). A "run once" is often used to clear entries after deïnstalling a program, a "run" when you install software (so only allow when you have deinstalled/installed a program yourself through Windows add/remove programs or Run as administrator).

 

[Deleted member 178]

i wish i had the Enterprise version...

MS plan to remove GP from Pro version in the Anniversary update...

 

[hjlbx]

Time for hard-hacks for W10 Home and Pro...

 

[Deleted member 178]

Go Regedit ! , go !

 

[SHvFl]

i wish i had the Enterprise version...

MS plan to remove GP from Pro version in the Anniversary update...

Actually they are only removing some policies and not the whole thing. Most things will be there.
Microsoft removes policies from Windows 10 Pro - gHacks Tech News

 

[juhful]

Glad I have the Education Edition!

 

[Shran]

Glad I have the Education Edition!

Me too, I just installed it (I was using Pro up until 2 days ago)

 

[DardiM]

Thanks for the share

 

[StriderHunterX]

Me too, I just installed it (I was using Pro up until 2 days ago)

Is there an added benefit to this version? I always had the impression of Pro,Enterprise and Ultimate to be the most secure ones.

Also,thanks to @Windows_Security for this.I've been extra paranoid lately and this gives me some ideas.

 

[DardiM]

Is there an added benefit to this version? I always had the impression of Pro,Enterprise and Ultimate to be the most secure ones.

I use Bitlocker on my Pro version

 

[StriderHunterX]

I use Bitlocker on my Pro version

I need to master that tool,for my sake.Teaching users to benefit from this? Another issue,altogether...

 

[DardiM]

I need to master that tool,for my sake.Teaching users to benefit from this? Another issue,altogether...

Just right click on the drive letter where you want to activate Bitlocker, and follow the instructions.
Very easy. Each time your PC start, BitLocked Drives are protected, no data seen / accessible.
You just have to right click on the BitLoked drive and choose "unlock", to access it.

Apart from my C: Drive, all my Drives are with BitLocker activated (D, E, F, G, H, I)

 

[jamescv7]

A right one to learn what is hardening mode is all about.

In such business landscape, limited user accounts is not enough but rather use the OS itself to configure for lockdown protection.

Very effective and less sacrifice on the resources; yes it needs technical analysis but the investment is good.

 

[Logethica]

Excellent post @Windows_Security ...
Thank you for taking the time to create it

 

[ZeroDay]

Fantastic post Windows_Security. This should be pinned in my opinion.

 

[Av Gurus]

Do we need remove LNK extension (This adjustment allows you to use your desktop shortcuts and Quick Launch icons, which are mostly the LNK filetype) or add some (like: JSE, JAR, PS1, VBS, JS, SCT, VBE, WS, WSF, WSH)?

 

[Windows_Security]

No not when you set default level to BASIC USER. You have to remove lnk when you set DISALLOWED as default level. Disadvantage of disallowed, is that the RUN as ADMIN registry tweak from Symanatec for MSI files does not work.

Thx @Av Gurus for this excellent suggestion to add some file extensions (I was forgotten to mention it, apologize). See picture, please repeat for file extension mentioned by Av gurus: JSE, JAR, PS1, VBS, JS, SCT, VBE, WS, WSF, WSH)

 

[Av Gurus]

When this SRP settings is applied, to we need to set user to SUA or we can leave it to Admin?

 

[Nikos751]

Great article!
Is Google Chrome update affected in any way (automatic or manual) after this configuration? Is an exception needed to be set? Chrome runs from the user folder in most home pc's and can be updated manually asking for admin priviledges (UAC) or automatically without asking anything.