13 ms·
The whole exploit relies on the non admin user being able to run regedit.exe - every sane lockdown policy blocks the execution of this application by non-admins
by Jaruzel 7y ago
The whole exploit relies on the non admin user being able to run regedit.exe - every sane lockdown policy blocks the execution of this application by non-admins as a matter of course. If you are not locking regedit.exe down, then you might as well just throw all your policies out of the window.
- amanzi 7y agoYou would only need access to regedit on another computer, e.g. a home computer, to modify the settings.
- Jaruzel 7y agoAgain, how would you get the mandatory profile file onto the work machine? re-enforcing my original point, if the USBs ports are open, or email attachments aren't being filtered, you've blown your desktop security anyway. I did this stuff as my job for 10 years. Windows XP was like swiss cheese, Windows 7 was much better, and now Windows 10 is rock solid; if you go all out on the security settings, an average user cannot break in or elevate themselves.