Configuring Forced DLL Relocation

This feature forces relocation of those dynamic-link libraries (DLLs) that have opted out of the Windows native ASLR feature. Some malware relies on these DLLs always being loaded at the same and known addresses. By relocating such DLLs, these attacks are prevented.

Configure rules to add one or more executables to Forced DLL Relocation.

Task	Syntax	Description
Bypass executables from Forced DLL Relocation.	`sadmin attr add –v <filename1 ... filenameN>`	Specify one or more protected components where you bypass Forced DLL Relocation. For example, `sadmin attr add –v AcroRD32.exe`
Enforce Forced DLL Relocation on executables.	`sadmin attr remove –v <filename1 ... filenameN>`	Specify one or more components where you enforce Forced DLL Relocation. For example, `sadmin attr remove –v AcroRD32.exe`
List the executables that Forced DLL Relocation bypasses.	`sadmin attr list –v`	Lists all components that Forced DLL Relocation bypasses. For example, `sadmin attr list –v`
Flush Forced DLL Relocation rules from all executables.	`sadmin attr list –v`	Removes Forced DLL Relocation rules from all executables. For example, `sadmin attr flush –v`
Bypass a DLL module that is loaded for a specific process.	`sadmin attr add -o module=<DLLmodulename> -v <processname>`	Bypass the DLL module name for a process. For example, `sadmin attr add –o module=wuauserv.dll -v svchost.exe`