sandboxie-plus / Sandboxie

Sandboxie Plus & Classic
https://Sandboxie-Plus.com
GNU General Public License v3.0
12.8k stars 1.43k forks source link

Sandboxie programs do not terminate after closing programs that run as admin with UseCreateToken/SandboxieAllGroup enabled #4030

Closed offhub closed 1 day ago

offhub commented 1 week ago

Describe what you noticed and did

If the last program that terminated in the sandbox was running as an administrator and the setting UseCreateToken/SandboxieAllGroup is enabled, SandboxieXXX programs within that sandbox will persist and continue running instead of terminating.

  1. Set UseCreateToken=y
  2. Run sandboxed CMD (as Admin)
  3. Close CMD
  4. SandboxieDcomLaunch.exe and SandboxieRpcSs.exe remain.

How often did you encounter it so far?

Every time

Expected behavior

They should not linger in the box.

Affected program

Any program as admin

Download link

Not relevant

Where is the program located?

The program is installed only outside the sandbox.

Did the program or any related process close unexpectedly?

No, not at all.

Crash dump

No response

What version of Sandboxie are you running now?

Sandboxie-Plus 1.14.3 64-bit

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression from previous versions?

No response

In which sandbox type you have this problem?

In a standard isolation sandbox (yellow sandbox icon).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

What is your Windows edition and version?

Windows 10 Pro 22H2 64-bit (19045.4529) and Windows 11 Pro 23H2 64-bit (22631.3447)

In which Windows account you have this problem?

A local account (Administrator)., A Microsoft account (Administrator)., An account with UAC protection set to Always notify.

Please mention any installed security software

Microsoft Windows Defender

Did you previously enable some security policy settings outside Sandboxie?

No response

Trace log

No response

Sandboxie.ini configuration

UseCreateToken=y
SandboxieAllGroup=y
DropAdminRights=n
FakeAdminRights=n