HotCakeX / Harden-Windows-Security

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | Read The Rationale https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md
https://hotcakex.github.io
MIT License
1.84k stars 143 forks source link

[Bug]: Edge GPO #236

Closed reuvygroovy closed 7 months ago

reuvygroovy commented 7 months ago

Tools category

Harden Windows Security Module

Does your system meet the requirements?

Is your Windows installation genuine?

Please explain the bug

In the registry resources you search for this key: "Registry Keys",Edge,HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\Recommended,BlockThirdPartyCookies,Block 3rd party cookies,DWORD,1,https://learn.microsoft.com/en-us/deployedge/configure-edge-with-mdm

The path is incorrect, but should rather be without the word Reccomended: https://admx.help/?Category=EdgeChromium&Policy=Microsoft.Policies.Edge::BlockThirdPartyCookies

HotCakeX commented 7 months ago

It is correct.

This is the actual source, not that website https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#blockthirdpartycookies


image



image
reuvygroovy commented 7 months ago

From the admx files there are two entries

<policy class="Both" displayName="$(string.BlockThirdPartyCookies)" explainText="$(string.BlockThirdPartyCookies_Explain)" key="Software\Policies\Microsoft\Edge\Recommended" name="BlockThirdPartyCookies_recommended" presentation="$(presentation.BlockThirdPartyCookies)" valueName="BlockThirdPartyCookies">
  <parentCategory ref="microsoft_edge_recommended"/>
  <supportedOn ref="SUPPORTED_WIN7_V77"/>
  <enabledValue>
    <decimal value="1"/>
  </enabledValue>
  <disabledValue>
    <decimal value="0"/>
  </disabledValue>
</policy>

And two places in the GPO where they can be defined image

We force this setting (using the 1st option), and not reccomended which can be overridden by the user.

reuvygroovy commented 7 months ago

I can't paste the XML from the admx so here is a screenshot which shows both: image

HotCakeX commented 7 months ago

@reuvygroovy I know. You can see that in the readme that I set it as recommendatory policy because setting it to blocked for all users can break websites that rely on 3rd party cookies.