SRP from Windows 7 (and maybe higher)

Pre Win7

In Vista one could use SRP with the default Security Level set to Disallowed. Within unrestricted folders of windows and program files it was possible to set a Basic User rectriction on a program to keep it in a LUA-box. This would prevent UAC elevations for example of the programs with Basic User additional rules.

Post Win-7

Using a basic user additional rule caused a "prevented by group policy" message to appear. Basic User seemed to have the same effect as Disallow (default deny).

Microsoft did not publish a lot on SRP, since it had provided AppLocker as it successor (also SRPV2 internally ).

When you use Software Restriction Policies with default security level as Basic User and apply SRP for all files and users except Admin, you create a default deny execute for medium integrity level processes, but get th eoption to install (elevate) by using Run as Admin.

Besides this advantage for programs not needing document based start parameter (e.g. doubleclicking a word document starts word with that document), like Internet Explorer and Outlook, I found this strange basic user behaviour.

Set a program to run as basic user, drag a shortcut to menustart or taskbar and it will run from menu start and/or taskbar, but not from any other folder! It still allows to elevate through run as Admin.

See picture, left start from directory, right start from taskbar

 

When you apply SRP for all files and ALL users, the lua-box is back

See picture, you can't run IE elevated through run as admin, while you can run it with normally from taskbar and startmenu ('normal' start is with medium integrity level, same a s Basic User with user rights assigned of the Home Users group).

So I made a registry file to switch rules enforcement from ALL USERS to ALL USERS EXCEPT ADMIN and vice versa, for easy install from user space

 

Yes, I found the same the other day. I have to run all installations as Admin, otherwise SRP stops execution. SRP is enabled for non-admins only.

When Installer is in MSI file I run Total Commander as Admin and then just double-click the file. It installs with no problems...

 

See how to set default level and add additional rules

 

To run MSI as Admin apply Symantec tweak http://www.symantec.com/connect/downloads/msi-run-administrator-context-menu-vista


When in "SRP for All Users Except Administrators" mode, you can now install everything with Run As Admin from user folders.

Finally Safe_Admin on Win7 is as strong & flexible as it was on Vista

 

How's that you have 5 security levels for SRP?
On all my PC I have only 3.

 

Dead-ends left overs of trying to enforce LUA-box in Windows 7 as with Vista. Had forgotten they were still in registry, should clean registry

Now outlook can't elevate, I also added file and registry virtualization with RunAsInvoker tweak, see picture.

 

Thank you for this info, it will make installation a little more trouble-free

P.S.: how do you import those reg files? Batch file with reg import command and then shortcut with "Run as admin" option?

 

Just execute .reg file and it will show in context menu for MSI files (I also named it as "Run As administrator")

 

No, I meant the reg files you created to switch rules from All users to All users except Admins and vice versa. There is no Run as admin option on reg files...

 

When you place these reg files somewhere in a folder with no SRP restriction, create shortcuts of these reg files. Put them in startmenu. Selecting them will start regedit which will ask for elevation, since regedit and reg file are run from a safe place.

EDIT: You need to use secpol or gpedit

 

OK. Got it! Thank you for this explanation of SRP

 

This works when you set basic user as the default security level and add a rule for a program to run as basic user.

The option right click add to task bar and startmenu sometimes is sometime implemented differently, so try with right click (e.g. IE11), when that won't work (e.g. for Outlook), manually drag a shortcut to task bar/start menu

 

Basic User option for system wide setting works in Windows 8, but Basic User option for specific programs is still broken and will completely block the executions.

 

Do you know if there's any way to make a "button" to turn either SRP or Applocker on and off? That would be convenient.

 

Yeah, the "button" would be convenient. When I used them I had to manually switch SRP to "Unrestricted" and clear policy of AppLocker. Then manually switch SRP to "Disallowed" and import back the hashes of AppLocker and then add additional hashes.

 

I'm thinking you can probably just make a batch file to turn the Application Identity service on and off but I haven't messed around with that yet.

 

On Windows7 it works when you turn on basic user system wide and add a shortcut to taskbar or startmenu for an program given specific basis user rights.

- system wide: Security level = basic user default
- additonal rule for a program
- short cut in startmenu/taskbar

In Win 7 wil block execution in its own directory, but allows from startmenu/taskbar.

I only have win8 on my phone, so don't know, but I though tile execution sets a lua sandbox by default ?

 

Eh, never mind. It's broken in both modes, whether it's system wide or specific configuration. So the only available options are just black and white.

I assume that you're talking about pinning the programs to the taskbar. I've tried it in Windows 8 and they all are still blocked. Although the taskbar shortcuts are already there before I applied the SRP rules. I wonder if that really matters.

I'll try to messing around with SRP again today.

EDIT: Tried that, still didn't work.

 

NO: create a shortcut, and drag it into taskbar or menu start

You need to apply both see pic in Windows 7 to make it work.

It looks like Basic User SRP in Windows7 is a step to the tile sandbox in Win8. Win8 offers a LUA like sandbox by running programs in tiles.

 

I believe I've configured it that way. But I guess there's no harm in double checking.

 

Wel SRP worked differently from Vista to Win7, could well be that it is different in Win8. Thanks for trying.

 

Well, I love to fooling around.

So I tried it again, this time I captured some SS. SRP basic user still didn't work.



Since I was unable to create a shortcut within the program's folder itself, a shortcut was created in the desktop instead. What I did:

- Tried to execute the program by clicking the shortcut in the desktop --> Execution blocked
- Tried to execute the program by clicking the exexutable itself --> Execution blocked
- Dragged the shortcut to the taskbar --> Execution blocked
- Pinned the shortcut to the taskbar --> Execution blocked
- Pinned the shortcut to the start screen --> Execution blocked without warning
- Pinned the executable to the taskbar --> Execution blocked
- Pinned the executable to the start screen --> Execution blocked without warning

Thus, I declare that SRP basic user option is completely broken in Windows 8.

OT question, do AppGuard and EXE Radar also work in user space like SRP? Thanks.

 

See post 4 and 20, you need to set additional rule on the program file, not the folder. Try again It works on IE and Outlook, but not on Chrome (Chrome starts, but does not connect to internet).

 

Whoops, my bad...

How about now?



I also tried it with another program and got the same result.