This message was deleted.
# citrix-vads
Slackbot
11/09/2022, 2:42 PMThis message was deleted.
j
James Rankin
11/09/2022, 2:47 PMYes, do it in the build script to stop them being able to create subfolders. Hasn't broken anything
James Rankin
11/09/2022, 2:47 PM(Enforced by GPO also)
s
Steve Noel
11/09/2022, 2:48 PMdid something similar to C:\temp, but apparently it wasn't enough... Isn't this kind of like chasing wind though? They'll always have access to download/run things to their profile
j
James Rankin
11/09/2022, 2:48 PMSure, but it cuts off binary planting attacks
James Rankin
11/09/2022, 2:49 PMRun accesschk from sysinternals and you will be amazed what weak permissions are all over your drive
s
Steve Noel
11/09/2022, 2:49 PMyeah
j
James Rankin
11/09/2022, 2:50 PMaccesschk64.exe -uwdqs Users c:\*
👍 2
James Rankin
11/09/2022, 2:51 PMAnd besides running anything from %USERPROFILE% should be blocked
s
Steve Noel
11/09/2022, 2:51 PMlike whitelisted, or just in general? what about Teams or Zoom or software that installs as a user
j
James Rankin
11/09/2022, 2:52 PMI don't let Teams install into the user profile, but you can use AppLocker to allow very specific items
James Rankin
11/09/2022, 2:53 PMBlock everything but allow the bits you can't avoid (GTM was a pain for this, as was Bomgar)
s
Steve Noel
11/09/2022, 2:54 PMmake sense, I like that approach
j
James Rankin
11/09/2022, 2:56 PMThe NTFS way stops a "bad app" from installing, say to c:\Apps (which it creates itself with weak perms), and then a user can drop a custom DLL in there with a name that the program uses, and because of PATH searching it loads the malicious DLL when the app launches. Remove the default C: drive permission, and the user can't write to C:\Apps any more - problem solved
s
Steve Noel
11/09/2022, 2:59 PMyeah it does make sense, i just kept coming back to, the user still will have access to their 'downloads' directory to save/run things
Steve Noel
11/09/2022, 2:59 PMbut that doesn't mean the flood gates should be open
j
James Rankin
11/09/2022, 2:59 PMSave, sure, but execute - not really
👍 1
s
Steve Noel
11/09/2022, 3:03 PMare you just removing the top perm?
j
James Rankin
11/09/2022, 3:04 PMYes, that exact one, although the second one might need to go to
James Rankin
11/09/2022, 3:04 PMtoo*
James Rankin
11/09/2022, 3:04 PMReally they only need RX, AFAIK
s
Steve Noel
11/09/2022, 3:05 PMsounds good, will do some testing.
Steve Noel
11/09/2022, 3:29 PMwere you using Applocker (or insert another whitelisting software tool) to prevent things from running in %USERPROFILE%? Or were you doing NTFS stuff there too?
j
James Rankin
11/09/2022, 3:45 PMAppLocker, I don't screw with NTFS on user profiles
👍 1