Comments (9)
Hi,
Did you run the Set-OutputEncodingToUnicode.ps1
script in the Support folder before scanning the directories?
See also notes on pages 16 and 17 in the documentation.
from aaronlocker.
OK. Confirmed that it's a bug in AccessChk.exe that doesn't handle Unicode properly. Bug filed and hopefully resolved soon. Thanks for the alert.
from aaronlocker.
Sorry for getting to this so late - I wasn't getting notifications - hopefully I've got that straightened out. Dees7 does rmoreas' suggestion fix your issue?
from aaronlocker.
Hello.
No. Set-OutputEncodingToUnicode.ps1 did not help. I see "???" in xml.
from aaronlocker.
What does the output of this command look like by itself:
AccessChk.exe /accepteula -nobanner -w -d -s c:\windows\tasks
from aaronlocker.
C:\Users\user\Documents\AaronLocker\AaronLocker>AccessChk.exe /accepteula -nobanner -w -d -s c:\windows\tasks
c:\windows\Tasks
RW NT AUTHORITY\????????? ????????
RW BUILTIN\??????????????
RW NT AUTHORITY\???????
from aaronlocker.
Does the "AaronLocker" rule generation still work correctly in spite of this bug? The design intent is to rely on SIDs and not have to depend on successful SID-to-name conversion. The bug here makes it harder for a human to review the results of the scans of the Windows and Program Files subdirectories, but it shouldn't otherwise block generation of correct rules. Is that what you're seeing?
from aaronlocker.
Hello.
Yes AaronLocker rule generation works and applies correctly.
from aaronlocker.
OK. Sysinternals team has fixing the Unicode issue in their backlog now.
from aaronlocker.
Related Issues (19)
- How do we get signed scripts? HOT 2
- Just a thought regarding NonDefaultRootDirs
- GetSafePathsToAllow creates rules for only last path provided as many times as the number of paths listed HOT 3
- Additional config required for Windows Event Collector
- Unable to add exceptions using GetExeFilesToDenyList.ps1 HOT 5
- netlogon location HOT 3
- Unexpected Allow in WDAC Deny Rules from createpolicy HOT 2
- Question: WDAC Allow and Deny HOT 1
- AppLocker rule to deny Powershell not working as expected.
- Request: Intune ready Applocker XML files
- This repo is missing important files
- Request: Microsoft Sentinel Workbook to replace AaronLocker Excel Sheet
- Updating of documentation to include Code Integrity rules
- WDAC Events
- VirusTotal API integration
- WDAC rules are not generated on Windows Server 2019 HOT 1
- Create-Policies script triggers SentinelOne for Malware
- Custom AD group for UnSafePath HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aaronlocker.