Added
added wildcard support for RecoverFolder and AutoRecoverIgnore patterns (*, ?, **), matching across NT, DOS, and network-alias path forms in both DLL and SandMan #3761 #5318
added UseAutoRecoverIgnoreForQuick=[y|n] to apply AutoRecoverIgnore patterns to the Quick Recovery window (default: enabled) #5278
added pending-change highlighting to SandMan Options and Settings dialogs; it indicates unapplied changes and not controls whose changes take effect immediately
Options/HighlightPendingChanges (default: enabled), configurable in Global Settings > Interface Config > User Interface
Changed
reworked the crash dump mechanism
changed SandMan auto-delete recovery to reuse an already open recovery dialog as the delete decision dialog, regardless of filter state, instead of closing it or silently continuing with box deletion
Fixed
fixed Win32 process image path queries returning sandboxed paths, which could reveal that a process was running sandboxed #5437
fixed expected non-user SID profile and shell lookup noise by suppressing matching SBIE1406/SBIE1412 and derivative SBIE1204 FileRootPath messages #5422
fixed NT device path (DeviceLanmanRedirector...) shown in popup notification instead of UNC form, causing garbled display and wrong recovery target #711
fixed "Close until all programs stop" permanently suspending recovery when clicked while no processes are running
fixed SandMan Immediate Recovery blinking without showing the recovery window when the new-file event path and scanned recovery path differed only by casing, such as downloads vs. Downloads
improved SandMan responsiveness during SBIE message and notification floods by batching UI updates and reducing expensive per-row rendering
added workaround to Chrome settings reset, it can be disabled with 'UseChromeSecurePreferencesHack=n' #5184 #5286 #5180
this is more of a hack than an elegant solution, we make IsOS(OS_DOMAINMEMBER) return true and when accessing the host's "Secure Preferences" force a migration into the sandbox and remove all "*_encrypted_hash" entries
Note: this only works for settings and extensions; host credentials, cookies, passwords, etc. remain inaccessible from within the sandbox
if this is required, a manual workaround is required: reg add "HKLMSOFTWAREPoliciesGoogleChrome" /v ApplicationBoundEncryptionEnabled /t REG_DWORD /d 0 /f
adapt for MS Edge (SOFTWAREPoliciesMicrosoftEdge), Brave, etc.
fixed issue with DPAPI when running services as system in sandbox, this allows to access with Chrome host credentials, cookies, passwords, etc. when sandboxed
this requires to enable the elevation service to be sandboxed 'SandboxService=GoogleChromeElevationService' as system 'RunServicesAsSystem=y' and opening the SAM endpoint 'OpenSamEndpoint=y'
there is also a convenient template 'Template=Chromium_Elevation'
Note: each Chromium derivative has a different service name, like: MicrosoftEdgeElevationService, MicrosoftEdgeDevElevationService, MicrosoftCopilotElevationService, GoogleChromeElevationService, GoogleChromeDevElevationService, BraveElevationService