When you remove administrative rights for applications using the Remove Administrative Rights action, there is an advanced feature that allows you to apply restricted Security Identifiers (SIDs), further restricting access to securable objects.
When you specify any Restricted SID then not only does the Security Descriptor need to allow access to the user, but also allow access explicitly to the Restricting SID.
When to Use Restricted ID
- Use case for Restricted SID is creating a sandbox and then putting in place a Restricted SID to further restrict the apps in the sandbox.
- Anything that the Restricted SID is applied to will only get Read access to the user registry and won’t actually have Read to the local machine registry so it can do very little and a lot of apps may not work correctly under this model. And the same applies to the file system; not only do you as the user need access to a file but also explicitly has to have the Restricted SID. Ultimately, it’s just severely locked down.
Our restricted process option leverages the Windows functionality that prevents restricted SID's from having Write access to protected resources. (For more details, go to Restricted Tokens on the Windows Dev Center.) Another benefit of this is that Restricted Processes do not have rights to open any network-based resource, such as file servers.
Apply Restricted SID
To apply restricted SID, do the following steps:
- In the Security Manager Console, click the Policies tab.
- In the file library in the left pane, navigate to Arellia Solutions > Application Control > Actions > Process Rights > Remove Administrative Rights.
- In the right pane under Action Type, select the Apply Restricted SID (advanced) check box.
- Click the Save button.
Related Links
What is this thing called SID?