Forum Discussion
Venting about all the security features blocking my own local apps
I have Windows 11 Pro with a new laptop (a good brand with 32GB RAM). (I wanted a Surface, but way too expensive.) I am a retired .NET developer and I still code at home. I have a few personal apps that are run from task scheduler. Getting a laptop to start an app from the task scheduler in the middle of the night is a whole other discussion (laptops prefer not to stay in a state that task scheduler can wake from).
But let's say I have apps that upload files to my personal web site. I have needed to:
- add firewall rules for the apps in whatever folders they run from;
- add Windows Security exceptions for the EXEs and folders;
- move the EXEs to folders under Program Files because Device Guard otherwise blocks them (I don't want to bother with signing the apps), and trust me when I say you don't want to try to disable Device Guard, and there is no way to add exceptions to Device Guard;
- wonder why aka.ms/myrecoverykey has been messed up for days;
- adjust Visual Studio Debug settings to refer to the Program Files locations;
- log extensively from my apps because I never know what new Windows feature will block them, and watch obscure event logs such as CodeIntegrity;
- constantly update third-party modules (Nuget, etc.).
Yeesh, I just want to post a message of the day on my own web site.
3 Replies
- GaryGoGoGoBrass Contributor
UPDATE from the O.P. - I am developing on a new personal laptop, my first laptop purchase in a few years. It has 32GB RAM and a terabyte of space, (in my opinion) a development-class laptop. But it was not made clear to me at the time of purchase that this device is sold with consumer-level (strict) Smart App Control security. I have used Settings to disable SAC, but it isn't really disabled. Some of the security is burned into BIOS. There are still policy files in C:\Windows\System32\CodeIntegrity\CiPolicies\Active. I tried to review the CIP files, but this requires booting into safe mode. As a developer on this device, I need to self-sign my own local apps to allow debugging from bin\debug. Every time I add a nuget package, new security annoyances appear. I am concerned that I am one Windows Update away from being unable to debug and run my own EXEs without paying for CA-signed certificates.
I would like to spend my time playing with AI. I want to have fun. But noooooo, every day or two I have to track down a new security issue blocking my EXEs. This is not fun and not protecting me from anything. - underQualifriedIron Contributor
I am right here with you, from a completely different angle. Trying to login to an account to approve a device management update. a basic change that took me 20 seconds to make.
took me an hour to login. My sign-in kept getting blocked because Entra would either apply a Conditional Access policy the user is excluded from, OR because it decided my MFA wasn't MFA, or because I'm signing in too much, or because it decided to try forcing me to register new MFA info despite Registration being off. Entra has a lot of optional functionality that can be turned on/off, but defaults to 'Microsoft managed'. I have to turn it all to OFF because Microsoft Managed is just asking for trouble. Turns out, you're STILL forced to take Microsoft's 'recommendations' even when they're off.
Here's a screenshot of it refusing to validate the email it demanded I validate (and asking me to press a button that doesn't exist). 63 minutes after making the change, Entra finally stopped making up reasons to block the sign-in and let me in.
Here's a screenshot of all my MFA methods just randomly disappearing because apparently they're not important.
pretty infuriating to be dealing with such clear dysfunction over some really basic stuff, and then read Satya Nadella babbling about AI becuz he wants his elite bonus. Ironic too, when he wrote an entire book about 'rediscovering microsoft's soul and making a better future for everyone'... and now he's just another uninspired, overpaid CEO pushing cosmetic changes and shallow AI platitudes - GaryGoGoGoBrass Contributor
I made some changes to an application that had been running OK under Program Files, and now Windows won't run it any more (Program Files is not sufficient). I had to self-sign the EXE. This is a self-developed EXE that is never to be made public. Self-signing works, it is the correct solution, but it's a lot of tedium for a non-issue.