full-disclosure

Open Source and information security mailing list archives

Date: Wed, 1 Mar 2023 00:25:50 +0100
From: Andy Ful <hardconfigurator@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] SRP on Windows 11

The correction to:
Full Disclosure: Defense in depth -- the Microsoft way (part 82):
INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2
(seclists.org) <https://seclists.org/fulldisclosure/2023/Feb/13>

The Kanthak correction to restore SRP functionality on Windows 11 ver.
22H2, works only when Smart App Control is OFF. If it is in Evaluate or ON
mode, then the invalid registry values are automatically restored after
restarting Windows.
To restore SRP on all SAC modes, one should not delete registry values but
simply set the "RuleCount" value to 0:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000000

Windows restart is required.

Regards:

@Andy Ful
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives