List of things that break when using SRP

[mavhc]

I'll start:

 

DISM, solution: use /ScratchDir (have to create dir first)

DisplayLink driver install

Sophos update. Solution: whitelist update exes (except they change)

Sysinternals utils that pick a 32/64 bit version automatically. Solution: copy from %temp%

[mavhc]

SIMS census, SIMS .net\SREngine.exe.

 

Reason: Capita can't program their way out of a paper bag. I guess they hard coded in the path instead of using the variable

 

Solution: Add path rule for C:\Program Files, and/or C:\Program Files (x86) in addition to the default registry based rules

[mavhc]

Stand alone Windows Update/System Readiness Tool, installs to random c:\ folder. Solution: I just disabled SRP on that computer until I'd fixed it

[free780]

Just wondering why people are still using SRP instead of applocker?

[Arthur]

Stand alone Windows Update/System Readiness Tool, installs to random c:\ folder. Solution: I just disabled SRP on that computer until I'd fixed it

Create a Publisher Rule in AppLocker allowing Microsoft apps. Problem solved!

[Cache]

Just wondering why people are still using SRP instead of applocker?

 

Only a Pro licence or only got pro deployed possibly?

[mavhc]

Pro is free. Give as little money to microsoft as possible.

 

"Pay us more so you can more easily secure the crap we write"

[TechMonkey]

I'll start:

Sophos update. Solution: whitelist update exes (except they change)

 

Can't remember if SRP has it but can you set a publisher rule? That would allow any updated file to be run as long as Sophos have correctly sign their files.

[Fazza]

FireFox uses the %TEMP% folder as part of it's install so that wont install for us. Our workaround is I tried adding it to the SCCM Software Centre and that installs OK.

 

The NET2 security door software also doesnt work as it uses an AppData folder during the installation.

 

*EDIT*

 

With regards to Paxton's NET2 software, it uses the WISE Installer and after a quick google, if you use the /M option it prompts you for the temp folder location so we just chose another location and now it works

Edited June 7, 2016 by Fazza

[jthompson]

NOVA-T6 (satellite installation) doesn't run correctly under our SRP. The usual 'Restricted by Group Policy' events in the event log aren't generated, which would normally point us to the path(s) we'd need to allow in the SRP.

[mavhc]

Have you tried added C:\Program Files and (x86) specifically, instead of the normal registry based variables?

[jthompson]

Have you tried added C:\Program Files and (x86) specifically, instead of the normal registry based variables?

 

Yes, I have those. The satellite (standalone) installation of NOTA-T6 installs to C:\SNOVA, but I've included that path as well. From memory, the app launches, it's just so broken that it's unusable. I'm still to move our SIMS server over to SOLUS3, so I was going to look at this afresh once I'd worked through all of that.

[mavhc]

MS Office 2010, tries to run from temp, solution: add cert from ose00000.exe found in temp

[pete]

^ Office 2016 too.

 

My SRP rules are mostly about not allowing random malware to run from user-writable temporary areas, with exceptions for specific legitimate installers.

 

(Yes, I know I should do a default deny + whitelist legitimate things, it's on the list of stuff to do.)