Whitelist control

[Stefan4]

I know this is probably a very silly question but I installed securaplus and removed all of the certificates and compacted the database, I only want to trust what I currently have installed. After this as a test I downloaded open office. I was expected to be prompted to accept the installation/application and instead, the application installed and was automatically trusted, why has this happened?

Thanks

[hendy]

Did you also delete the restricted application list? Probably your browser is no longer in the list. Because the browser is signed, if it is not in the restricted app list, it can turn into an installer. This will mean that whatever files that it downloaded wll be automatically trusted.

[Stefan4]

That makes sense. No I left the restricted application list but I guess that's what's happening. I will add it in and give it a try. Thanks

[Stefan4]

so, I have tried adding my browser into the restricted list, and still no joy, though I'm sure this is the problem. I am using windows 10 and Microsoft edge. I have added Microsoftedge.exe and  MicrosoftedgeCP.exe into the restricted list. Can anybody help with what program I need to add into the restricted list?

[hendy]

You need to add one more: browser_broker.exe
We will add those files into the list on our next release. Thank you for informing us.

[Stefan4]

Great, that worked thank you

Now, my final problem is that I can still install and run apps from the windows store, I'm assuming there some more programs that I need to add to the restricted list.

Thanks

[hendy]

Windows store is using the same process as what Windows usually use to perform Windows update, to download and install the applications. To restrict this process will cause an issue in the automatic Windows update, which will mean that everything updated by Windows will not be trusted. This may cause the OS unable to run properly because the new files will get blocked. Even let's say if we are able to restrict the process, there will be an issue in how to trust the files that download by Microsoft Store. According to our observation, currently the applications are stored at C:\Program Files\WindowsApps forlder. This folder is protected by Windows. If you are trying to access this folder from Windows Explorer, you will get access denied.

[Stefan4]

Ok, makes sense. From what I have read, all store apps are signed by Microsoft so as long as apps aren't side loaded I should be fine. I was just wanting to use white listing to minimise the attack surface and prevent users installing random applications.