Lockdown

NOTE: REMOVAL OF DEFAULT RULES CAN RENDER WINDOWS UNUSABLE.

When reaching the victim’s computer, ransomware or any other malware usually executes programs without the user’s consent. Lockdown is an application meant to prevent such unauthorized actions by leveraging the Windows Software Restriction Policies.

Before using Lockdown, please keep in mind that it is designed for advanced users only, as you must be familiar with the Software Restriction Policies (or, in short, SRP) to be able to understand how it works. Misuse of the application might render Windows unusable.

The structure of the interface is simple, with a few tabs that give you full control over the application’s actions and behavior. You can toggle Lockdown on or off with the click of a button but it is not advisable you do so until you have defined the whitelisted programs. The reason behind this is that Lockdown treats all the programs as if they were on its blacklist, except a few locations that are whitelisted by default, as detailed below. It might happen that the applications you are using daily don’t work anymore while Lockdown is active, unless you whitelist them.

There are dedicated tabs for whitelisted and blacklisted programs, which you must populate manually with the names of the executable files (or their locations) that are allowed or not allowed to run, respectively. In case of applications that use non-standard locations (such as the AppData folder), Lockdown must be disabled for them to work.

Going back to the default configuration of Lockdown, you should know that there are a few locations that the application automatically adds to its whitelist. To be more specific, these are the Windows directory and all its subfolders, the Program Files and the Lockdown folder itself, as well as all the shortcuts (just the shortcuts, not the file at the end of it). These settings can be changed but please note that tampering with the default rules might result in the impossibility to use your computer.

If you require Lockdown to allow specific applications in certain locations (such as the Downloads folder or the Windows desktop) to run, then you must add them to the whitelist manually. Unfortunately, Lockdown does not allow you to browse for an executable file when populating the whitelist and the blacklist so you will have to type in or paste the path yourself. Any modification to the whitelist, blacklist or Lockdown requires a computer restart for the changes to take effect.

Lockdown is meant to prevent the launch of programs without consent or from non-standard locations, which is usually the case with malware. However, you can also use it to block certain applications in Windows (like a parental control application), although its approach to blacklist everything requires you to build up a pretty long list of allowed applications.