Add to the list of Windows defenses that don't seem to do anything:
Starting with Windows 11 22H2, Software Restriction Policies (SRP) no longer seem to do anything.
Hopefully nobody is relying on this capability!
2 problems:
1) NTFS-level no-exec perms catch EXE and friends. But not other things like JS, HTA...
2) Path-based Software Restriction Policies work way better for blocking things that run.
The kicker: Starting with Win11 22H2, newly-created policies don't work.
Bugs everywhere!
6
36
6
99
Just in case you are not aware - I sorted it out. Although SRP is declared as deprecated, the flaw was caused by MS shipping a registry setting with it's install media, that defines AppLocker although it's not active.
borncity.com/win/2023/02/24/…
1
1
1
6
Danke! I'll see if I can confirm when I get the chance.
Feb 24, 2023 · 3:53 PM UTC
2