Default rules - typo??

Hi guys.

Just double-checking through me rules as there were a few mistakes pointed out to me,and i came across a couple of default rules in the 'web browser protection' group.

HKEY_USERS\.default\Software\Microsoft\Windows\Currentversion\Internet settings

with the values of 'safety warning level' , 'security_runactivexcontrols',etc.

I thought about changing the '.default\' part to a '*' to cover the 's-1-5-21' keys aswell,so i checked the registry to see if those values were present in the other keys before i made any changes,and guess what? they're not,nor are they present in the keys listed the group .

So i did a search,and found the following two keys:-
hkcu\software\microsoft\internet explorer\security / safety warning level
hku\s-1-5-21-1****\software\microsoft\internet explorer\security / safety warning level

The other values 'security_runactivexcontrols,security_runscripts and trust warning level' aren't in my registry at all .

Anyone else have this? Anyone found other keys/values that don't match?

 

Sometimes a Key/Value can be used by malware and if the Key/Value does not exist on a particular machine the malware will simply create it. Protecting a non-existant item will prevent that from happening at no real cost to you.

With the key you mention I'm currently protecting:-

HKEY_USERS\*\Software\Microsoft\Internet explorer\Main**

With no ill effects, so try it and see what it's like with you.

Incidently, if you add:-

HKEY_CURRENT_USER\Software\Microsoft\Internet explorer\Main

and protect all values on that key, you will get rather more log activity!

 

Thanks TopperID ,yeah,already got the keys you mentioned.