0

My googling came up with nothing useful. I assume others must have ran into this too.

If we start the Network Troubleshooter wizard it generates some temp ps1 files that are blocked silently to the end user, because of the default script rules (allow program files/windows locations but not user writable directories). How do you suggest we deal with this, just don't allow the troubleshooter, or create tons of exclusions?

Problem being that the logged in user has full control over their temp folder. I assume an attacker can find that we exclude this directory/files and just create a bad script in that location? The scripts are not signed by MS unfortunately.

e.g.

%OSDRIVE%\USERS\USERNAME\APPDATA\LOCAL\TEMP\1\SDIAG_2CCAF8AA-5B69-4911-8442-4BADBCF4C26E\NETWORKDIAGNOSTICSTROUBLESHOOT.PS1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.