Allow custom blocking of "SystemSpace"

[User82931]

Hi.

I read all documentation so if I am mistaken somewhere, I apologise.

As far as I can see, all things within "SystemSpace" from below can be ran by default without whitelist.
‘Windows’
‘Program Files’
‘Program Files (x86)’ - only on Windows 64-bit
‘ProgramData\Microsoft\Windows Defender’.

I find this rather problematic. Is it not possible to remove this? This can be problematic in some instances. Let me give you an example.

As you might have heard, lately there are a lot of steam games with malware. The most common practice is, the game is uploaded to steam as a legit game, and later the game is updated with malware. As users often install steam games in default location so under Program Files (x86), these malware have freedom to just run from that folder.

If it's not possible to remove all together the ability to remove these "SystemSpace" folders because they might break windows, could you please at least make it so you can blacklist certain folders within "SystemSpace" and then whatever executable you want to run from within that, you can whitelist individual files.

So to give an example. I'd like to blacklist the whole steam folder C:\Program Files (x86)\Steam, and then manually choose which files are allowed to be ran by it. This is already the case when I install games in UserSpace locations - games don't run, updates fail, unless I manually whitelist them, which is what I want for SystemSpace.

Thanks.

[User82931]

https://www.youtube.com/watch?v=eAqNd6ipCGs

There's been countless malware games on steam in the recent months

[AndyFul]

You cannot use H_C for this. You can use H_C with Smart App Control on Windows 11, but some games can be partially blocked. Another solution is using something like AppControl-Manager. However, such a configuration requires some knowledge about Microsoft App Control for Businesses.
https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager

[User82931]

Why cant H_C do this? You can achieve something like this using AppLocker from secpool.msc. I noticed though when I use AppLocker, H_C stops working. Is it not possible to make it so H_C works with AppLocker?

[AndyFul]

Microsoft does not allow working SRP with AppLocker. But, even if it does, such an application would be too complex for home users. You should also block DLLs. If you need more complicated software, you can follow the suggestion from my previous post. It will work independently of H_C.