Windows 10: How to prevent creation of list of applications launched

How can I prevent the Registry from creating a list of applications launched from external media? I have App launch tracker turned off, but registry nevertheless contains an entry for example.exe previously launched from, and only contained on, a thumb drive? TIA

:)

 

How to prevent creation / modification of shortcuts for users (Active Directory domain) ?

Hello everyone !

So here is my first question to the community: How do we prevent the creation and / or modification of shortcuts by users of an Active Directory domain?

Why ?

Well in order to prevent, among others, ransomware attacks.

You know, these small files that a user (with no antivirus up to date) downloads via his mailbox and hide your folders. Then, change the path of the existing shortcuts (or by creating them) in order to direct anyone to the diabolical executable.

Your help would be truly valuable !

Thank you.

***Post moved by the moderator to the appropriate forum category.***

 

How to prevent creation / modification of shortcuts for users (Active Directory domain) ?

Hello Christopher,

This kind of issue is more complex than what is normally posted here in the Community. We suggest that you post your query in our
MSDN Forum for further assistance.

Regards.

 

Hello *Smile

Are you referring to the list that Windows keeps in the registry key UserAssist? These entries are encrypted but there are tools that allow you or others to view it. This is how someone can monitor all the programs that you have ever run on your device.

CCleaner has an option to remove these entries. There maybe tools that can turn off the logging of these entries but this is not something that you can do within the windows system settings or privacy settings as far as I know.

 

Thanks PhilC. My registry entry came up on a plain text search in the Regedit search function, so I'm not sure about the encryption of the entry?? I'll wait a day or so in case anyone comes up with a direct removal method (presumably I can just delete it through regedit, but I heed the awful warnings) before saying 'solved'.

 

If it was a plain text entry then it is something else. Windows logs just about everything you do!

 

Computer\HKEY_USERS\S-1-5-21-266190730-1346868948-1307986354-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\SIGN.MEDIA\hexstring example.exe Reg Binary long binary hex string Sole entry - so you're saying there will be other 'invisible' entries eraseable with CCCleaner?