Secure File Open With Dialogue
This post will show you how to secure the File Open-With dialogue box that will potentially allow an attacker to access areas of your virtual desktop that you would otherwise not want them to.
Overview
In a multi-user environment you often have several applications installed on a single Windows system and either publish applications to the user or grant them access to a desktop hiding various items from the start menu. Whilst on the surface this may seem sufficient to stop your users accessing things they should not, I have seen attackers use the File Open dialogue to access applications on a server that they should otherwise not have access to.
The problem here is that if you do not have a load of master images and want that single image nirvana then you need a way to lock apps to only the users that you deem necessary as you will often have ALL the apps installed on the same, single master image.
There are a ton of ways to do this, and if it were me I would probably use 1, if not all of them, however for the purpose of this post I am going to show you one step in that process:
Hide the “Right Click, Open With” dialogue
The Security Issue
First let me show you what this specific issue is meant to defend against.
If we log into a Windows 11 machine and open up File Explorer you can see we have 2 files there
Now if we right-click on the Text Document and select Open With we get the option to “Choose another app”
Clicking this displays a list of all the applications associated with that file extension, from here we can click on “Choose another app on your PC”
This will open up a File dialogue and allow us to browse the local drive for any application we deem fit.
Please note that you should have your Local Drives locked down, if you want help doing this please read my article on doing so.
So if we now go ahead and open up the text document using Excel
Then, once open use the Excel search bar to look for “Macros”
Give the Macro a name in the pop-up dialogue and click on Create
This will give you access to the Visual Basic editor and allow you to write and execute any code you wish, all from opening up a text document.
Registry Fix
Luckily there is a relatively quick fix for this but in my opinion It’s not so elegant.
Open up the registry editor
Then navigate to the following key
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
Locate the Open With Key and delete it
Next time you try and use the right click open with dialogue you will see its gone!
FSLogix To The Rescue
The above method is good, and it works, however, what if:
- As an Administrator you still want the functionality
- You “forget” to implement the fix on a single VDA
This will leave you open to attack and not be something you want.
Let’s have a look at how FSLogix can help.
History
FSLogix was bought by Microsoft and It’s pretty much available now to everyone who is using Virtual Desktops. Whilst this is great and a big win for profiles there is another component to FSLogix that can help us here, its called “App Masking”
This gives us the ability to hide applications, files and registry keys based on group membership. With this in mind we can hide the right click open with key from all users except the Administrators. This means that as an Admin you can still use the functionality but if you are a regular user (as I hope your users are!) you won’t see the key as its masked.
To learn more about installing FSLogix click here
FSLogix Fix
Start by opening the FSLogix Rule Editor from one of your VDA’s
Select a location to save the new rule set
Select the option for a “Blank Rule Set”
Right click in the pane to the right and select “New Rule”
Select “Hiding Rule” from the drop-down and click Browse
Select “Registry Key”
Browse to the following registry key
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
Select OK and accept any changes that FSLogix Apps Masking suggests
Click Manage Assignments
Select to “Rule set does apply to user/group” for Everyone and add Administrators as a group, selecting “Rule set does not apply to user/group”.
Save and copy the FSLogix rules according to the installation guide for FSLogix above and test as a regular user.
You will see that FSLogix is “Masking” the registry key from the user and therefore not showing it.
Conclusion
This is a quick win and a simple one to implement. As with everything like this is it not foolproof and also is not a complete win-win, but it will help to go some way down the path to securing your VDA’s and stopping your users getting access to things they should not have access to.
