Welf Alberts

Hey Joe.

Boot Windows Setup, it will not ask your for any credentials. Will edit my tutorial accordingly.

@Water Lover
Yes, isn’t that nice… they committed the change back in October and document it now, almost 4 months later. Found the same today, just came here to add it 🙂

Hi.

Psexec does not need to be installed. Extract it from pstools, follow the given steps, report what you see.

Is it necessary to point out that the script itself needs to be whitelisted? You will have whitelisted a lot of scripts (like those in sysvol) and it should be obvious that this script needs to be among them. Best would be to digitally sign it with a whitelisted signature.

Can you tell me why you think the script is (sometimes?) unable to delete the old configuration? Have never seen it failing to do that. Can you offer reproducible steps to make it fail?

About 1) – what’s the problem here? Again I don’t understand what could possibly go wrong at your side

Enforcement mode configured to “enforce rules” within all sections (exe, script, MSI) of the GPO?

Ok, enough trying to say for sure.

With Win10 22H2 and 11 22H2, you may use GPOs to control Applocker without my script. No matter if upgraded or clean install, it works. Don’t forget that standard applocker relies on the server “appidsvc”, so your GPO needs to change the startup type of that service to automatic.

[yes, earlier I wrote that it didn’t work on 22H2 – the service wasn’t active]

Will edit my article accordingly.

I made two attempts:

On Win11 Pro 22H2 (clean install) AppLocker works out of the box without my script.
On a VM with Win10 Pro 20H2 it didn’t work and after upgrading that to 22H2 (19045.2364), it still does not work.

Will do further attempts with 11 22H2 when upgraded from 11 RTM and 10 22H2 when cleanly installed.

Hi Brandon.

I would expect every comfortable solution to have a downside, security-wise.
And that should be considered as well.

For example: how secure are security question? NIST no longer recognizes those as an acceptable authenticator by SP 800-63.
As your screenshot shows, those can be combined with SMS verification and push notifications and so on, but who is able to tell how secure this is against abuse? Try to put a number to it, that will be hard. Ideally, every pw reset system needs to be as secure as the pw itself; providing reset options should make it easier for an attacker to steal an identity, so giving an estimate of how secure this combination of reset verifications is, should be mandatory.

Furthermore, I would like to know whether this software works with passwords only or whether it can also reset forgotten SmartCard PINs (for windows authentication).

Walter, David…
Say, how funny is this… all these years, it didn’t work on pro. Here comes my scripted solution for pro, BAM, 6 months later, it works out of the box.

That would be astounding, indeed. I misunderstood at first 🙂
So you tested this without using my script and things that you define in gpedit.msc get blocked?

Walter, this works on all Win10. Tried successfully on 21H2 Pro as well. So I am not sure how your gpedit.msc looked like, but surely that was a problem at your end.

Richard, you quote me writing “at little cost” and later “there are costs” – and seem to feel those are contradictory statements. The costs for those licenses are small, compared to their benefit, if you ask me.
I don’t express “there are no costs”. Maybe you misunderstand when I encourage readers to try this out by writing that setting up a lab requires less than one hour and costs nothing (since the server trial setup allows for several months of free usage, local and RDP.).

Hi Rizan. The above tutorial is no cure for “cannot join”. Use the forum here, open a thread, offer details what error messages you see when trying to join.

Sabine, the proof of concept is not meant for repeated runs. You have not reacted to my suggestion before, which told you what lines to execute now to overcome this.

Fine, thanks for the feedback!

Saw Sabines Screenshot and that’s something different to Georges’s problem. Use the delete_all_rules part (lines 3-20) in the lowest code, then retry.