curwin

We would like to restrict access to removable storage on our Windows 10 machines to one process (preferably via file hash). Is that possible using something built into Windows - Group Policy, Powershell, etc? Thanks, David

It's really a shame. They should have made Windows 10 more secure, not open up new vulnerabilities.

I have found a solution in this link: https://social.technet.microsoft.com/Forums/office/en-US/b168408e-a540-4e3a-92cc-3121486ceb78/admin-shares-available-to-nonadministrative-users-over-loopback-address?forum=winserversecurity The registry fix solves the problem!

For security purposes, we want to prevent our users from accessing the C drive on their computers and on the terminal servers. These users are *not* local admins on either their workstations or the servers. We have implemented the following Group Policy settings: - Remove Run Menu from Start Menu - Hide these specified drives in My Computer - Restrict C drive only -Prevent access to drives from My Computer - Restrict C drive only This does prevent the users from accessing the C drive from Windows Explorer. However, if they enter \\127.0.0.1\c$ or \\localhost\c$ they can access the C drive from any of these ways: Internet Explorer / Edge Chrome A link in Microsoft Word How can I prevent this? I repeat - they are not admins in any form, and yet they can access the C drive via the administrative share. (I am also not the only person reporting this problem). I would be happy to block access to any UNC paths (as long as I can still map drives for them), or to prevent or misdirect 127.0.0.1/localhost. But nothing I have tried works, and I really need to prevent this. Any ideas? It's most important for me to find a way to block this on Windows 10 Enterprise, but it seems to be an issue in various Workstation and Server operating systems. Thanks, David

Unfortunately, that's not the case. We've hired professionals to perform penetration tests, and even a non-admin can run commands that allow them to snoop around at things they shouldn't, and even run code that can download malware or elevate privileges. Google "pen test" or "rundll32.exe and bypass" for examples.

There are many malicious commands that can be run using legitimate Windows executables such as rundll32.exe or regsvr32.exe. However, they can't be blocked entirely, because they are necessary to run basic Windows features such as Control Panel applets.

Right, the first setting does hide the search box or icon. (The second one isn't relevant to search). The problem is: a) The user can simply change the setting to display the search box or icon b) There are other ways to open the search tool - Windows+Q / Windows+S, or the Search item in the Start Menu.

We are trying to prevent our users from running various commands that we don't specifically approve. We have implemented Applocker, but that doesn't prevent the user from running commands beginning with rundll32.exe or regsrv32.exe. In previous versions of Windows the group policy setting "Remove Run menu from Start Menu" was sufficient. But in Windows 10, when a user starts typing any command in search, even with that GP setting enforced, the command runs. Is there any way to prevent this? It is a significant security issue, and I am surprised that Windows 10, which is generally more secure, in this issue is actually less so. If not, is there at least a way I can prevent access to the search field? I've already found it on the task bar (even if I set it to "hidden", the user can switch it back to "show search icon" or "show search box"), in the alphabetical list of programs (under "Search") and via the Windows+S and Windows+Q hotkeys. I tried renaming the folder C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy That did disable the search function entirely, but it went too far for our needs. It would prevent the users from running their programs from the Start Menu. For example, they couldn't just start typing "Word" and have Microsoft Word open. Any ideas will be welcome. Thanks! David