Security Prompts for Internet Shortcuts (in Favorites Folder)

Page 3 of 4 FirstFirst 1234 LastLast

  1. Posts : 10,485
    W7 Pro SP1 64bit
       #21

    XLR8TX said:
    UsernameIssues, Excellent Info.

    After conversing with other users on several forums, I knew those prompts were not there before for most if not all users.

    Do you know of any workaround for this?
    Let Pyprohly and I talk about a few more things before we reach a suggested solution.
      My Computer


  2. Posts : 10,485
    W7 Pro SP1 64bit
       #22

    Pyprohly said:
    We are dealing with the Integrity Label-ed case of security prompts, clearly.

    When a shortcut (.lnk) or .url file has a Low Mandatory Integrity Label, Windows will prompt consent from the user when the shortcut is invoked—as already observed.
    It sounds like you have been seeing this prompt for a while now... even prior to the installation of KB3185319. It makes sense to see the security prompt, but I (and others) have not seen it in the past.



    Pyprohly said:
    But as it turns out, none of the shortcuts in the Favorites folder themselves actually carry a Integrity Label. What’s happening is, they are inheriting a Low Mandatory Integrity Label from the Favorites folder. Because IE runs with low integrity, the files associated with it will also be of low integrity, and therefore if IE is to write these files to the Favorites folder the Favorites folder must also bear a Low Mandatory Integrity Label.
    IE11's parent process is responsible for writing shortcut files to the Favorites folder (and sub-solders). Dragging/dropping the URL from IE11's address bar to the Favorites bar (the Links folder) indicated that IE's parent process (in this case, PID 568) created the URL shortcut. That parent process should be running at the Medium Integrity Level.

    Security Prompts for Internet Shortcuts (in Favorites Folder)-ie11-medium.png

    I repeated the shortcut creation process with Process Monitor filtered to only show the file actions for IE11's child process (in this case, PID 2180) - I got no entries at all.

    Security Prompts for Internet Shortcuts (in Favorites Folder)-ie11-low.png
    I brought up the filter after dragging/dropping the URL from IE11's address bar to the Favorites bar.



    Pyprohly said:
    XLR8TX, the security prompt you see is ordinary behaviour and I recommend you don’t try and change it.
    It seems like the correct behavior, but I assure you that it has not been happening ever since I started using W7. I have double clicked on various IE shortcuts from the Favorites folders within Windows (file) Explorer and I've not been seeing this prompt. This double click usually happens when I want to see a website in a non-default browser. After I drag/drop the shortcut to the non-default browser, I sometimes decide that I also want to see it within my default browser too (IE). This is accomplished via a regular double click on the shortcut file from within Windows (file) Explorer. I should have seen the security prompt during the drag/drop operation and the double click operation (based on what I think I know about Mandatory Labels)... but I don't see it.

    None of the computers that I oversee at the office have KB3185319 installed (yet). None of the ones that I tested create the security prompt and I don't know/understand why that is.
      My Computer


  3. Posts : 721
    Windows 10, Windows 8.1 Pro, Windows 7 Professional, OS X El Capitan
       #23

    Welcome to the thread, UsernameIssues. That information you’ve provided is certainly useful for uncovering the nature of this KB3185319 hotfix (13 Sep 16)… I think I get the full picture now.

    Although those command prompt screen captures reveal no dissimilarities between the shortcuts of Windows installs with and without hotfix KB3185319 applied, it asserts that the low integrity label on the shortcuts in the Favorites folder have always existed. Yet, it turns out, despite the integrity labels having always existed on them, those shortcuts in the Favorites folder have not always produced a security prompt. From my testing, it is indeed correct fact that KB3185319 has introduced these security prompts for shortcuts in the Favorites folder.

    So, if the security warnings are caused by low integrity levels set on shortcuts, why weren’t they apparent before hotfix KB3185319? What’s changed?

    I’ve seen security prompts appear on low integrity-ed shortcuts many times before, and have learned to associate low integrity levels and shortcuts with these prompts. I am right in this respect but applying this knowledge to this scenario is a mistake as we are not dealing with integrity levels and shortcuts (.lnk), we are dealing with integrity levels and internet shortcuts (.url).

    Internet shortcuts would never present a security prompt before the hotfix. Now, however, it seems Microsoft have decided to use the security prompt for both shortcut and internet shortcuts.

    I feel this is more of a bug fix rather than a significant security change.


    UsernameIssues said:
    Pyprohly said:
    We are dealing with the Integrity Label-ed case of security prompts, clearly.

    When a shortcut (.lnk) or .url file has a Low Mandatory Integrity Label, Windows will prompt consent from the user when the shortcut is invoked—as already observed.
    [...] It makes sense to see the security prompt, but I (and others) have not seen it in the past.
    Don’t lie. I know you know as much as I do about these security prompts.


    XLR8TX said:
    Do you know of any workaround for this?
    XLR8TX, if you are so desperate to remove all security prompts from the Favorites folder, you may run the below command, but once this tweak is applied I cannot help you revert the change.
    Code:
    icacls "%userprofile%\Favorites" /setintegritylevel m
    Edit: Probably don’t run that command. I have not tested it’s effects. IE may have trouble writing to this location if the command is applied, and if it is, theres no going back.
    Last edited by Pyprohly; 22 Sep 2016 at 11:49.
      My Computer


  4. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #24

    Hi,
    I would usually delete the default folders in favorites and just use my own folders to save to or drag and drop too,
    I haven't had any popups like this since.

    I do this mostly because if I reset internet explorer my favorites are unaffected.
      My Computer


  5. Posts : 10,485
    W7 Pro SP1 64bit
       #25

    Pyprohly said:
    UsernameIssues said:
    Pyprohly said:
    We are dealing with the Integrity Label-ed case of security prompts, clearly.

    When a shortcut (.lnk) or .url file has a Low Mandatory Integrity Label, Windows will prompt consent from the user when the shortcut is invoked—as already observed.
    [...] It makes sense to see the security prompt, but I (and others) have not seen it in the past.
    Don’t lie. I know you know as much as I do about these security prompts.
    In the context of this thread, this statement:
    "It makes sense to see the security prompt, but I (and others) have not seen it in the past."
    was meant to convey:
    "It makes sense to see the security prompt, but I (and others) have not seen it in the past when double clicking on URL shortcuts from within the Favorites folder."

    I've been double clicking on those URL shortcuts for years and I have not seen the security prompt in the past. I've started a discussion with the IT department at work concerning the security implications of changing the Mandatory Label on the Favorites folder (and each sub-folder?).
      My Computer


  6. Posts : 20,583
    Win-7-Pro64bit 7-H-Prem-64bit
       #26

    Hi,
    I believe the issue is because ie11 will always update the url's or gather from the site to preload faster
    It's been an annoying setting that can not be set to anything else but Automatically
    Security Prompts for Internet Shortcuts (in Favorites Folder)-ie11-annoying-setting.png
      My Computer


  7. Posts : 721
    Windows 10, Windows 8.1 Pro, Windows 7 Professional, OS X El Capitan
       #27

    UsernameIssues said:
    I've been double clicking on those URL shortcuts for years and I have not seen the security prompt in the past. I've started a discussion with the IT department at work concerning the security implications of changing the Mandatory Label on the Favorites folder (and each sub-folder?).
    See my edit, I doubt this is a good idea, IE may depend on it.

    And I’m hesitant to test it out because I don’t know of any method of reapplying the integrity label once it’s lost. These things aren’t documented well, and it agonises me that there is a Windows setting I can’t manipulate.


    @ThrashZone Interesting. A very convincing theory.
      My Computer


  8. Posts : 10,485
    W7 Pro SP1 64bit
       #28

    To further add to the confusion:

    LNK shortcuts do not cause a security prompt when double clicked on from the Favorites Bar folder... even after installing KB3185319. I've not tested WEBSITE shortcut files yet.

    edit: WEBSITE shorcuts do cause the security prompt after the installation of KB3185319 :-(

    This makes no sense to me. I thought that I understood a bit about Mandatory Labels at the folder level and the file level. As noted above, I've been working with these labels for a while now. I've seen them many times - just not when double clicking on a URL shortcut in the Favorites folder via Windows (file) Explorer. I did not even know (or care) about the Mandatory Labels for that folder until this thread.
      My Computer


  9. Posts : 10,485
    W7 Pro SP1 64bit
       #29

    XLR8TX said:
    UsernameIssues, Excellent Info.

    After conversing with other users on several forums, I knew those prompts were not there before for most if not all users.

    Do you know of any workaround for this?
    Much to my surprise, dragging a URL shortcut from Windows (file) Explorer and dropping it into a browser's window does not cause the security prompt. Please test this and let us know if it is a good work around for you.
      My Computer


  10. Posts : 10,485
    W7 Pro SP1 64bit
       #30

    ThrashZone said:
    Hi,
    I believe the issue is because ie11 will always update the url's or gather from the site to preload faster
    It's been an annoying setting that can not be set to anything else but Automatically
    Security Prompts for Internet Shortcuts (in Favorites Folder)-ie11-annoying-setting.png
    The security prompt is generated before IE starts. It also happens if Chrome is the default browser. It is some strange change to the way the OS treats Mandatory Labels on URL and WEBSITE shortcuts after KB3185319 is installed. The behavior did not change for LNK shortcuts.

    The behavior before installing KB3185319 confuses me. There should have been a security prompt* before installing KB3185319.The behavior after installing KB3185319 is not consistent (e.g.no prompts for LNK shortcuts).

    *when double clicking on any shortcut in the Favorites folder (and its sub-folders) from within Windows (file) Explorer
      My Computer


 
Page 3 of 4 FirstFirst 1234 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:01.
Find Us