<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-CA link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Dirk – and others:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m not a core developer, but I have some experience with AppLocker. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I believe your IT staff or perhaps even yourself ought to be able to code an “Allow” permission exception in AppLocker, based for instance on the guidance at <a href="https://www.tenforums.com/tutorials/124016-use-applocker-allow-block-script-files-windows-10-a.html">https://www.tenforums.com/tutorials/124016-use-applocker-allow-block-script-files-windows-10-a.html</a><o:p></o:p></p><p class=MsoNormal>You will have to allow scripts in directory %userprofile%\AppData\QGIS\QGIS3\PROFILES\DEFAULT\PROCESSING<o:p></o:p></p><p class=MsoNormal>Or something like that, I don’t have AppLocker active to test it out; it’s wherever the offending batch files get placed.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>With all respect to innocent users like you caught in the middle, I do feel that an application, like QGIS, that does processing can very reasonably be expected to need to write and execute dynamic script files to communicate with other programs. This is, in fact, arguably exactly why script files were invented many years ago. Blanket forbidding their execution is a simplified but overzealous security policy measure, and your IT department should be willing to work with you to create an exception for your use case. In fact, the running of scripts in a user-writable directory, whether they are dynamically generated by trusted software like QGIS, or written manually by you, is a pretty standard tool in running replicable geospatial analysis of any sort. So I think the appropriate analog you should use in discussing with your IT dept is that it would be equally unreasonable to preclude you from running any new program (executable) files on your computer if you were a developer who was compiling code!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On Fri Jun 17 05:06:18 PDT 2022, Dirk.Pispers at STADT-KOELN.DE wrote via qgis-developer:<o:p></o:p></p><p class=MsoNormal>> Hi list,<o:p></o:p></p><p class=MsoNormal>> refering to the post "Blocking of SAGA & GRASS batch files by MS AppLocker<https://www.mail-archive.com/qgis-developer@lists.osgeo.org/msg51408.html>" <o:p></o:p></p><p class=MsoNormal>> in Aug 2020 I would like to reopen the discussion about the SAGA/GRASS/AppLocker problem.<o:p></o:p></p><p class=MsoNormal>> I my organisation AppLocker has recently been activated und the generated batch files from SAGA and GRASS processings are blocked now.<o:p></o:p></p><p class=MsoNormal>> Since switchting to a different file location is not a valid solution as Nyall Dawson postet in 2020, is it possible to submit the command directly in QGIS instead of writing it into a batch file und call this file?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:9.0pt;mso-fareast-language:EN-CA'>---<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;mso-fareast-language:EN-CA'>Martin Pergler<o:p></o:p></span></p><p class=MsoNormal><span lang=FR-CA style='font-size:9.0pt;mso-fareast-language:EN-CA'><a href="mailto:mp@pergler.org"><span lang=EN-CA style='color:#0563C1'>mp@pergler.org</span></a></span><span style='font-size:9.0pt;mso-fareast-language:EN-CA'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>