v1.1.3

SecureAppLocker v1.1.3

This release focuses on tightening system-level security and introducing a transparent, zero-trust approach to background process management.

New Features & Improvements

System Tools Hardening
We added a dedicated setting to instantly protect critical operating system binaries. This was implemented to prevent local administrators from easily bypassing the locker or terminating the background service. Since forcefully killing the service via Task Manager results in a BSOD, restricting access to tools like Command Prompt, PowerShell, MMC, and Registry Editor eliminates alternative termination vectors. This leaves Safe Boot as the only viable bypass route for a local admin.

• How to use: Navigate to the "Security" tab and toggle "Lock OS Management Tools". This will automatically add the targeted system tools to a managed protection list. You can view these managed tools under your standard app list in the "Apps" tab.

Strict Parent-Child Process Validation
The background service now uses NTDLL to accurately trace the execution tree of any launched process.

• How it works: If a locked application (e.g., powershell.exe) is spawned by a parent process that is either currently unlocked or explicitly trusted, the password prompt is bypassed. This ensures that your legitimate development environments or wrapper scripts can function uninterrupted in the background while unauthorized calls remain blocked.

Audit Logging & Trusted Exceptions UI
This feature provides precise control over the conditions under which locked applications can be invoked by other programs. By default, background tasks and third-party apps (such as a browser extension calling cmd.exe) are blocked from launching protected tools.

• How it works: When an unauthorized background call is intercepted, the service silently kills the process and logs the event instead of throwing a disruptive password prompt on your screen.
• How to use: Open the new "Audit Logs" tab to view a list of blocked background processes, complete with their parent names and exact command-line arguments.
  • Click Trust Parent to whitelist the parent application, allowing it to freely spawn locked tools.
  • Click Trust Command to whitelist a specific command execution. Note: When trusting a command, a dialog will appear allowing you to trim the command line. Make sure to remove dynamic parameters (like random session IDs or pipe names) and keep only the static, unique keywords (e.g., xdm-app-host.exe) so the rule works on future executions.
  • You can review and revoke any of these granted permissions in the "Trusted Exceptions" section at the top of the Audit Logs tab.

State Management & SafePID Resets
Internal process caching has been tightened. SafePIDs and active application immunities are now immediately purged and reset whenever the configuration is updated or the Windows session is locked. This ensures no permissions are left lingering as zombie states.