how to disable run via search on Windows 10?

[curwin]

We are trying to prevent our users from running various commands that we don't specifically approve. We have implemented Applocker, but that doesn't prevent the user from running commands beginning with rundll32.exe or regsrv32.exe. In previous versions of Windows the group policy setting "Remove Run menu from Start Menu" was sufficient. But in Windows 10, when a user starts typing any command in search, even with that GP setting enforced, the command runs.

 

Is there any way to prevent this? It is a significant security issue, and I am surprised that Windows 10, which is generally more secure, in this issue is actually less so.

 

If not, is there at least a way I can prevent access to the search field? I've already found it on the task bar (even if I set it to "hidden", the user can switch it back to "show search icon" or "show search box"), in the alphabetical list of programs (under "Search") and via the Windows+S and Windows+Q hotkeys.

 

I tried renaming the folder C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy

 

That did disable the search function entirely, but it went too far for our needs. It would prevent the users from running their programs from the Start Menu. For example, they couldn't just start typing "Word" and have Microsoft Word open.

 

Any ideas will be welcome.

 

Thanks!

 

David

[Localtechie]

Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search]

"SearchboxTaskbarMode"=dword:00000000

 

Should disable the search box we also use it to diable the task view icons as well which is

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]

"ShowTaskViewButton"=dword:00000000

 

We put this reg change on the default profile so this is what everyone gets at login.

Edited March 1, 2017 by Localtechie
spacing

[mavhc]

What security issues are there?

[curwin]

Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search]

"SearchboxTaskbarMode"=dword:00000000

 

Should disable the search box we also use it to diable the task view icons as well which is

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]

"ShowTaskViewButton"=dword:00000000

 

We put this reg change on the default profile so this is what everyone gets at login.

 

Right, the first setting does hide the search box or icon. (The second one isn't relevant to search). The problem is:

 

a) The user can simply change the setting to display the search box or icon

b) There are other ways to open the search tool - Windows+Q / Windows+S, or the Search item in the Start Menu.

[curwin]

What security issues are there?

 

There are many malicious commands that can be run using legitimate Windows executables such as rundll32.exe or regsvr32.exe. However, they can't be blocked entirely, because they are necessary to run basic Windows features such as Control Panel applets.

[mavhc]

There are many malicious commands that can be run using legitimate Windows executables such as rundll32.exe or regsvr32.exe. However, they can't be blocked entirely, because they are necessary to run basic Windows features such as Control Panel applets.

 

Surely a non admin user can't do anything bad if your system is secure.

[curwin]

Unfortunately, that's not the case. We've hired professionals to perform penetration tests, and even a non-admin can run commands that allow them to snoop around at things they shouldn't, and even run code that can download malware or elevate privileges. Google "pen test" or "rundll32.exe and bypass" for examples.

[mavhc]

https://insights.sei.cmu.edu/cert/2016/06/bypassing-application-whitelisting.html

 

Well, better move to ChromeOS then, nothing else is securable.

 

Or write wrappers for all those programs that run other programs, that look at user permissions

[curwin]

It's really a shame. They should have made Windows 10 more secure, not open up new vulnerabilities.