This message was deleted.
# _generals
Slackbot
09/17/2021, 5:27 PMThis message was deleted.
c
c4rm0
09/17/2021, 5:33 PMyou can set that which silently denys the elevation request
m
Mike Streetz (O_P)
09/17/2021, 5:34 PMi don’t think domain logon scripts need elevation though
Mike Streetz (O_P)
09/17/2021, 5:35 PMI’m in an environment where I have 0 control over AD and they are enforcing logon scripts that I’d like to block
Mike Streetz (O_P)
09/17/2021, 5:35 PMI have access to edit a single policy that applies to these machines so was trying to block the scripts with applocker
c
c4rm0
09/17/2021, 5:36 PMsorry i thought u meant UAC just re read it its applocker
c4rm0
09/17/2021, 5:38 PMin applocker you have script rules could you just block the path to the netlogon folder in sysvol
c4rm0
09/17/2021, 5:57 PMi think even the applocker default rules would do the trick as it allows everyone to run scripts from windows/program files so scripts from \\corp.com\Netlogon would be blocked. Have you done that and getting this prompt from applocker?
d
Dennis
09/17/2021, 6:30 PMI don’t think this is possible with AppLocker. Maybe AppMasking as an alternative?
m
Mike Streetz (O_P)
09/17/2021, 8:09 PMYes thats the prompt
Mike Streetz (O_P)
09/17/2021, 8:10 PMMaybe app masking to null will do it
n
Nathan Sperry
09/18/2021, 6:08 AMNot possible. So as @Dennis suggested use AppMasking to block wscript.exe, you could even tie that down to the launching gpscript.exe process (assuming the login script is in a GPO). If not then maybe winlogon.exe. Unless of course your happy to block wscript.exe for the users entire session.
5 Views