Troubleshoot ConfgureDefender - Core Isolation Windows 10

[Elmo's Jackhammer 95]

Briefly explain your current issue(s)

Preventing registry modifications and PowerShell commands.

Steps taken to resolve, but have been unsuccessful

Whitelisted the commands in VoodooShield and checked AV for possible blocking but nothing in the logs.

Hi,

I apologize if this isn't the right place for this issue, but I'm having a problem with ConfigureDefender not being able to save the configuration settings as it's saying there's another security program preventing registry modifications or PowerShell commands.

VoodooShield was blocking at first but I allowed it through and nothing in my AV is showing up in the logs to show that it's blocking anything. I've done a reboot and tried again but receive the same message.

I was wondering if Core Isolation which is a built-in feature with Windows (not enabled by default) might be the root cause?

Thanks,
Looking forward to the communities insight

 

[oldschool]

I was wondering if Core Isolation which is a built-in feature with Windows (not enabled by default) might be the root cause?

You make no mention of your current PC security configuration. Looks like you haven't edited it in a while.

Disable VS, change CD settings, hit Refresh and close GUI. Successful? Re-enable VS.

I've never known Core Isolation to interfere with ConfigureDefender settings.

,

 

[Elmo's Jackhammer 95]

You make no mention of your current PC security configuration. Looks like you haven't edited it in a while.

Yes, I haven't been on the forums in a while. I'll post my new configuration and report back with your suggestion, maybe even take couple of screen snippets for you to see.

Thanks!

 

[Elmo's Jackhammer 95]

Follow-up: I disabled VoodooShield > changed CD settings > Hit refresh but received the same error when doing so.

Also, I noticed this message when checking CD's info tab.

There's two snippets, hope it helps.

 

[ForgottenSeer 85179]

In the past I used Core Isolation and it doesn't interference with Andy tools.
Sounds more like your security programs

 

[oldschool]

I disabled VoodooShield > changed CD settings > Hit refresh but received the same error when doing so.

The likely culprit is Cylance, famous for FPs, etc. Have you checked it out?

 

[Elmo's Jackhammer 95]

The likely culprit is Cylance, famous for FPs, etc. Have you checked it out?

Yeah, I looked in the Events log in Cylance but nothing is showing up. Do you think SharpApp might be the cause of this?

I can always try and upload the rules that are currently set on my config.

 

[oldschool]

Do you think SharpApp might be the cause of this?

I have no idea since I don't know this app or what others you may have.

Have you hardened your OS with Group Policy or some other method?

 

[Elmo's Jackhammer 95]

I have no idea since I don't know this app or what others you may have.

Have you hardened your OS with Group Policy or some other method?

Here's the link to the app I was referring to: SharpApp | built by Bel ❤︎

Also, here's the snippet of the scripts running from it:

Also, not to my knowledge have I hardened it through Group Policy.

 

[oldschool]

here's the snippet of the scripts running from it:

That's your likely culprit. Check your settings and descriptions, etc.

 

[Elmo's Jackhammer 95]

That's your likely culprit. Check your settings and descriptions, etc.

Thanks oldschool, I will go through them later and see if that works.

Cheers!
Appreciate the help

 

[ForgottenSeer 85179]

Here's the link to the app I was referring to: SharpApp | built by Bel ❤︎

Also, here's the snippet of the scripts running from it:
View attachment 245303

Also, not to my knowledge have I hardened it through Group Policy.

This tool use group policy.
Reset everything back to stock

 

[Andy Ful]

Also, I noticed this message when checking CD's info tab.

There's two snippets, hope it helps.
View attachment 245295
View attachment 245296

The first error is due to applying SharpApp restrictions (by the way, did you disable Microsoft Defender?).
The second is probably caused by some other security.
One cannot safely use SharpApp, because this application cannot restore the Windows default settings (big issue).
The advanced user can probably use PowerShell command-lines to revert the restrictions manually (much work needed).

 

[Elmo's Jackhammer 95]

The first error is due to applying SharpApp restrictions (by the way, did you disable Microsoft Defender?).
The second is probably caused by some other security.
One cannot safely use SharpApp, because this application cannot restore the Windows default settings (big issue).
The advanced user can probably use PowerShell command-lines to revert the restrictions manually (much work needed).

Thanks for the insight, it's not a big issue for me as I'm using it as my main. (Yes I did)
I appreciate your help Andy!

Cheers!

 

[Andy Ful]

Yes I did)
...

So, ConfigureDefender (which configures WD) will be useless to you.