Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a big fan of Software Restriction Policies for Microsoft Windows and was recently updating our settings for this. I became curious as to where Microsoft implemented this technology in the stack. I can imagine a very naive implementation being in Windows Explorer where when you double click on an exe or other blocked file type, that Explorer would check against the policy. I call this naive because obviously this wouldn't protect against someone typing something in a CMD window. Or worse, Adobe Reader running an external application. On the other hand, I can imagine that software restriction policies could be implemented deep in the stack almost at the metal. In this case, the low level loader would load into memory the questionable file, but mark the memory in the memory manager as non-executable data.

I'm pretty sure that Microsoft did not do the most naive implementation, because if I block Java using a path block, Internet Explorer will crash if it attempts to load Java. Which is what I want. But I'm not sure how deep in the stack it's implemented and any insight would be appreciated.

share|improve this question

closed as not a real question by Ward, Scott Pack, mdpc, Magellan, John Gardeniers Oct 25 '12 at 9:28

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

"In the stack"? What "stack" are you referring to? – joeqwerty Jan 11 '11 at 15:45
It sounds like you could quite easily test whether a few of your guesses are true or not? – GAThrawn Jan 11 '11 at 18:09
@joeqwerty By stack I mean the technologies making up the Windows Operating system starting at the lowest level being drivers, with several middle levels of windows code, followed by the highest level of user interface programs, such as Windows Explorer or the CMD shell. See – Knox Jan 11 '11 at 21:54
@GAThrawn I did test the naive level, as I mentioned in the OP and can rule out the most naive implementation. Alas, as I move down the stack, it's beyond my capability. – Knox Jan 11 '11 at 21:56