OptionsWindow
0
0
622
473
0
0
0
0
16777215
16777215
SandboxiePlus Options
-
-
true
QTabWidget::West
0
General Options
-
0
Box Options
-
-
Sandbox Indicator in title:
Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
-
1
10
1
-
-
Block access to the printer spooler
-
Block network files and folders, unless specifically opened.
-
Drop rights from Administrators and Power Users groups
-
Sandboxed window border:
Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
-
Prevent change to network and firewall parameters
-
Qt::Horizontal
40
20
-
px Width
Qt::AlignLeading|Qt::AlignLeft|Qt::AlignVCenter
-
0
0
16
16777215
-
75
true
Appearance
-
-
75
true
Protect the system from sandboxed processes
General restrictions
-
-
0
0
Allow the print spooler to print to files outside the sandbox
-
Qt::Vertical
20
40
-
75
true
Protect the system from sandboxed processes
Printing
-
Remove spooler restriction, printers can be installed outside the sandbox
Run Menu
-
You can configure custom entries for the sandbox run menu.
true
-
Qt::Vertical
20
40
-
Name
Command Line
-
0
0
0
23
Add program
-
0
0
0
23
Remove
File Options
-
-
Qt::Vertical
20
40
-
Copy file size limit:
-
kilobytes
-
Protect this sandbox from deletion or emptying
-
Auto delete content when last sandboxed process terminates
-
75
true
File Migration
-
75
16777215
-
Issue message 2102 when a file is too large
-
75
true
Box Delete options
Auto Start
-
Here you can specify programs and/or services that are to be started automatically in the sandbox when it is activated
true
-
Type
Program/Service
-
0
0
0
23
Remove
-
Qt::Vertical
20
40
-
0
0
0
23
Add program
-
0
0
0
23
Add service
Program Groups
-
-
Add Group
-
Add Program
-
Remove
-
Qt::Vertical
20
40
-
true
Name
-
You can group programs together and give them a group name. Program groups can be used with some of the settings instead of program names.
true
Forced Programs
9
9
9
9
-
-
Remove
-
Force Folder
-
true
Type
Path
-
Force Program
-
Qt::Vertical
20
40
-
Show Templates
-
Programs entered here, or programs started from entered locations, will be put in this sandbox automatically, unless thay are explicitly started in another sandbox.
true
Stop Behaviour
-
-
Remove Program
-
Qt::Vertical
20
40
-
Add Leader Program
-
Add Lingering Program
-
true
Type
Path
-
Show Templates
-
Lingering programs will be automatically terminated if they are still running after all other processes have been terminated.
If leader processes are defined, all others are treated as lingering processes.
true
Start Restrictions
-
-
true
Name
-
Qt::Vertical
20
40
-
Remove Program
-
Issue message 1308 when a program fails to start
-
Add Program
-
0
-
Allow only selected programs to start in this sandbox. *
-
Prevent selected programs from starting in this sandbox.
-
Allow all programs to start in this sandbox.
-
* Note: Programs installed to this sandbox won't be able to start at all.
true
Internet Restrictions
-
-
Issue message 1307 when a program is denied internet access
-
Block internet access for all programs except those added to the list.
-
true
Name
-
Note: Programs installed to this sandbox won't be able to access the internet at all.
-
Remove Program
-
Add Program
-
Qt::Vertical
20
40
-
Prompt user whether to allow an exemption from the blockade.
Resource Access
-
-
true
Type
Program
Access
Path
-
0
0
0
23
Add Reg Key
-
0
0
0
23
Add File/Folder
-
Remove
-
0
0
0
23
Add Wnd Class
-
0
0
0
23
Add COM Object
-
0
0
0
23
Add IPC Path
-
Qt::Vertical
20
40
-
Move Up
-
Move Down
-
Qt::Vertical
20
40
-
Show Templates
-
Configure which processes can access what resources. Double click on an entry to edit it.
'Direct' File and Key access only applies to program binaries located outside the sandbox.
Note that all Close...=!<program>,... exclusions have the same limitations.
For files access you can use 'Direct All' instead to make it apply to all programs.
File Recovery
-
-
Qt::Vertical
20
40
-
Add Folder
-
Ignore Extension
-
Ignore Folder
-
Show Templates
-
Enable Immediate Recovery prompt to be able to recover files as soon as thay are created.
-
Qt::Vertical
QSizePolicy::Preferred
20
40
-
Type
Name
-
Remove
-
You can exclude folders and file types (or file extensions) from Immediate Recovery.
true
-
When the Quick Recovery function is invoked, the following folders will be checked for sandboxed content.
true
Advanced Options
-
-
50
false
0
50
false
Miscellaneous
-
-
Limit access to the emulated service control manager to privileged processes
-
75
true
Compatibility
-
Start the sandboxed RpcSs as a SYSTEM process (breaks some compatibility)
-
75
true
Protect the sandbox integrity itself
Sandbox protection
-
Qt::Horizontal
40
20
-
Don't alter window class names created by sandboxed programs
-
Open Windows Credentials Store
-
Do not start sandboxed services using a system token (recommended)
-
Open System Protected Storage
-
Allow access to Smart Cards
-
Force usage of custom dummy Manifest files (legacy behaviour)
-
Qt::Vertical
20
40
-
Protect sandboxed SYSTEM processes from unprivileged unsandboxed processes
-
Add sandboxed processes to job objects (recommended)
-
75
true
Protect the system from sandboxed processes
Lift security restrictions
-
75
true
Protect the sandbox integrity itself
Sandbox isolation
Auto Exec
-
Add Command
-
Qt::Vertical
20
40
-
Remove
-
Here you can specify a list of commands that are executed every time the sandbox is initially populated.
true
-
50
false
Hide Processes
-
Qt::Vertical
20
40
-
Add Process
-
-
Hide host processes from processes running in the sandbox.
true
-
Remove
-
Don't allow sandboxed processes to see processes running in other boxes
50
false
Users
-
Restrict Resource Access monitor to administrators only
-
Add User
-
Qt::Vertical
20
40
-
-
Remove User
-
Add user accounts and user groups to the list below to limit use of the sandbox to only those accounts. If the list is empty, the sandbox can be used by all user accounts.
Note: Forced Programs and Force Folders settings for a sandbox do not apply to user accounts which cannot use the sandbox.
true
Tracing
-
-
Qt::Horizontal
40
20
-
GUI Trace
-
IPC Trace
-
Pipe Trace
-
75
true
Access Tracing
-
Log Debug Output to the Trace Log
-
Qt::Vertical
20
40
-
File Trace
-
Key Trace
-
Log all access events as seen by the driver to the resource access log.
This options set the event mask to "*" - All access events
You can customize the logging using the ini by specifying
"A" - Allowed accesses
"D" - Denied accesses
"I" - Ignore access requests
instead of "*".
Qt::AlignLeading|Qt::AlignLeft|Qt::AlignTop
true
-
COM Class Trace
-
<- for this one the above does not apply
50
false
Debug
-
true
0
0
530
312
0
0
0
0
-
75
true
WARNING, these options can disable core security guarantees and break sandbox security!!!
true
-
These options are intended for debugging compatibility issues, please do not use them in production use.
true
App Templates
-
-
-
Filter Categories
Qt::AlignRight|Qt::AlignTrailing|Qt::AlignVCenter
-
Text Filter
-
-
true
Category
Name
-
This list contains a large amount of sandbox compatibility enhancing templates
true
Edit ini Section
-
Edit ini
false
-
false
Cancel
-
Qt::Horizontal
40
20
-
false
Save
-
QPlainTextEdit::NoWrap
-
-
QDialogButtonBox::Apply|QDialogButtonBox::Cancel|QDialogButtonBox::Ok