Show confirmation popup before running any downloaded program in Windows 10

Question

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a powershell script using cmd.exe /c "powershell.exe -ExecutionPolicy Bypass ...". Fortunately, I always noticed the extension before running it, but I may not always be so lucky.

I'd like to configure Windows (I'm using Windows 10 Education) to show a confirmation popup whenever I attempt to run any potentially malicious file (exe, msi, cmd, bat and ps1 for starters) outside a list of defined folders. I'm comfortable with GPO and powershell, would like to avoid solutions using 3rd party programs if possible.

I already tried to configure AppLocker, but

1. it outright blocks the file, which is usually not what I want, as I often download legitimate programs,
2. for some strange reason, it allows .lnk files with scripts as target.

Ideal scenario:

1. I run notepad.exe, located in C:/Windows/System32, which is whitelisted as a system folder, and it runs without any confirmation.

2. I download a file by torrenting, called awesomeMovie.mp4.exe, to a media folder, maybe D:/Movies/Downloaded. After clicking it, a confirmation dialog pops up, and I have to explicitly click Yes before the program runs. If the file was instead called awesomeMovie.mp4, it opens in my media player without any popup.

Answer 1

You will have to be careful where you download and store files, but there may be a simple solution.

On your download directory, edit the security settings (right-click, Properties, Security tab, Advanced button) and add a deny entry for execution for Everyone. Do the same for any directory where you would store these files.

Media files are only read, not executed---the player itself is executed, but it executes from its installation directory.

If you download legitimate executable files, you would simply need to move them to another directory where execution is permitted. If you prefer AppLocker, it should be able to restrict execution based on directory paths as well.

A word of warning: Either approach may not work properly or consistently with *.lnk files, as Windows seems to have some weird, undocumented handling for them in some cases. You still need to be careful.