This message was deleted.
# _generals
Slackbot
10/11/2023, 5:19 PMThis message was deleted.
k
Kasper Johansen
10/11/2023, 5:51 PMI did come across that issue. I don't think I ever found a workaround
r
Ray Davis
10/11/2023, 6:00 PMOkay, thanks, man. I hope you are doing well and the new role is going well.
đź’Ż 1
j
James Rankin
10/12/2023, 9:58 AMRedirect the cache somewhere else? (Painful, I know)
r
Ray Davis
10/12/2023, 11:29 AMYea that was another option we bounced around. The the problem that I see is that because the C location is being restricted from the browser if we redirect it to another location such as Docs or desktop(examples) that the variable that’s being used will still call %usename%\path which is c:\usename\location. Im spitballing here though without testing this.
Although cache drive or unc path could be an option. But will need to put sort of script to clean it up. Which adds more overhead for the folks doing the admin side. But that’s me spitballing things
j
James Rankin
10/12/2023, 11:32 AMTBH that should only be blocked if it actually uses the browser to go to the file. Is it an AppLocker GPO or a Chromium one you are using?
r
Ray Davis
10/12/2023, 11:35 AMYea that’s right. From my understanding what I sent yesterday a user received a email attachment and they tried to open it and from what I seen it was a link and it was referencing the path to the C location, which edge tried to open it up. I was trying to help a colleague out and it was secondhand information so I might not have all the details correct here but from the screenshot she sent me that is what it looks like.
j
James Rankin
10/12/2023, 11:36 AMCan you make the link open in Explorer instead?
r
Ray Davis
10/12/2023, 12:41 PMyea maybe.
m
Mike Streetz (O_P)
10/12/2023, 6:37 PMOutlook open everything in edge by default now, you can get it to use the default browser by going to Outlook Options > Advanced > Link Handling > “Open hyperlinks from Outlook in:” > Select “Default Browser”.
j
James Rankin
10/12/2023, 7:01 PMSo attachments open in the browser? Even if they're like, a document? Or does it respect the user-level FTA?
James Rankin
10/12/2023, 7:02 PMOh right, that's just if they're hyperlinks
m
Mike Streetz (O_P)
10/12/2023, 7:05 PMa lot of attachments will open in the browser, it’s something they did to teams too
Mike Streetz (O_P)
10/12/2023, 7:06 PMbut a lot of attachments are really sharepoint links
Mike Streetz (O_P)
10/12/2023, 7:06 PMespecially internally
l
Lacretia Bates
10/12/2023, 9:45 PMHere is what the users see:
Lacretia Bates
10/12/2023, 9:45 PMHere is the policy setting:
j
James Rankin
10/13/2023, 10:07 AMThat is ridiculously stupid if you're sending documents, IMO
r
Ray Davis
10/13/2023, 10:09 AMI don’t follow?
j
James Rankin
10/13/2023, 10:10 AMWhy would you set documents to open in the browser? Why not honour the FTA? And remove the risk of it being blocked by a policy which is intended to stop people digging through the filesystem using the browser
r
Ray Davis
10/13/2023, 10:11 AMOh i see now, yea I agree.
Ray Davis
10/13/2023, 10:15 AMSomething MS does it appears. There has to be a way around it. It’s aggravating because the default it wants to open from the C drive. But they (MS) also puts these setting in the edge hardening GPO in the security baseline tool. So I don’t know why they do it. But all in all it’s the dang INetCach lookup they do from the C drive, which in this case pulls up edge. It’s very annoying
Ray Davis
10/13/2023, 10:17 AMTemp workaround is to save the attachment to the docs. Then it should open
l
Lacretia Bates
10/13/2023, 1:11 PM@Ray Davis I gave them two options and told them I would try to find a different solution. Option 1 was to save it somewhere else that they have access to and then open it and Option 2 was to disable only the "file///C/" on the Edge policy. They opted for option 2 but I could hear the other Admin wasn't happy about it as he preferred option 1. Anyway, I was thinking there had to be a way around this but so far, I haven't found anything yet. I'm not giving up yet!
r
Ray Davis
10/13/2023, 6:12 PMAfter thinking on this more, There may be a way. @James Rankin mentioned the possibility of having it open Windows Explorer instead. I am not sure how to achieve this yet myself.
Basically, the concept would be around if the link is opened, somehow open file explorer to the Location instead. It's a long shot, but I am thinking about how to achieve this. Just not certain it's possible.
Ray Davis
10/13/2023, 6:43 PM@Lacretia Bates I went back and re-read the Define a list of allowed URLS. You can use this policy to open exceptions to restrictive block list. But, I am not sure if it will honor %username%.
Example
The block list has = file///C/
I was wondering if the allow list would work for : file///C/Users/%username%/AppData/Local/Microsoft/Windows/INetCache/
If I call it in the browser = file///C/Users/%username%/AppData/Local/Microsoft/Windows/INetCache/ = does not work
But if I call this in the browser = file///C/Users/ray/AppData/Local/Microsoft/Windows/INetCache/ = works
Ray Davis
10/13/2023, 6:48 PMMay be able to script something to insert it in for each user.
Ray Davis
10/13/2023, 6:48 PMNot sure yet though
Ray Davis
10/14/2023, 12:36 PMThis may be the ticket
# Retrieve the currently logged-in user's username$Username = $env:USERNAME# Build the URL for the URL allow list$URLToAdd = "file:///C:/Users/$Username/AppData/Local/Microsoft/Windows/INetCache/"# Set the registry path$RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"# Create a new registry key if it doesn't exist$URLAllowListKey = Join-Path $RegistryPath "URLAllowList"if (-not (Test-Path $URLAllowListKey)) {New-Item -Path $URLAllowListKey -Force}# Set the URL value under the URLAllowList keyNew-ItemProperty -Path $URLAllowListKey -Name "1" -Value $URLToAdd -PropertyType StringWrite-Host "URL $URLToAdd added to the allow list."