[1903, au] Help Working Out Start Menu Configuration?

[JRA]

It seems you can get REALLY "filthy" and just set deny permissions on the relevant folders by computer at least, so I can at least block these for kids. I'll have to re-visit every version I guess but tbh I think I'd have to do that with AppLocker regardless. I think...

 

Oh well, at least it solves* things for now...

[mavhc]

I have deny everything except c:\program files/x86, c:\windows, and a network drive that's read only. Then whitelist some other certs/exes based on paths/hashes

[JRA]

I have deny everything except c:\program files/x86, c:\windows, and a network drive that's read only. Then whitelist some other certs/exes based on paths/hashes

 

Cheers for that. I debated it but I can see that biting me when some software has a dependency of another bit and then doesn't say anything just refuses to work, and I spend forever chasing locked down thingies. Gone "the other way" by locking down the bad thingies as they come, rather than locking down all thingies and allowing the welcome thingies. If you don't mind me getting technical there. Also turned off the "run" and disallowed UNC browsing so can't get to C: or UNC paths unless you *sigh* use the search bar. Feckit then that's gotta go too.

 

Okay so I am getting there! Remaining things I've got left to do that I don't know how to do are KILL that freebie OneNote and freebie online "Office on the Web" bit with the orange icon. Anyone know where the .exes or apps are to those? Can't wait for them to die and they will as soon as I get paths.

 

Thank you everybody for helping me fumble through this one!

[mavhc]

it reports the error in the event log, so you can just forward all those to a central location to add exceptions where required

[JRA]

it reports the error in the event log, so you can just forward all those to a central location to add exceptions where required

Ah, that is a good idea and you are clever. Thanks. I'm all committed now to "my way" but I do like this now.