ConfigureDefender utility for Windows 10/11

[shmu26]

The Lsass rule sometimes does not start working immediately, right? Did you notice that with any other rules?

 

[Andy Ful]

The Lsass rule sometimes does not start working immediately, right? Did you notice that with any other rules?

No, I did not notice such behavior with other rules.

 

[Nightwalker]

Is it recommended to enable "Network Protection"? Seems to be a unstable protection feature ...

 

[Andy Ful]

Is it recommended to enable "Network Protection"? Seems to be a instable protection feature ...

There were problems with this feature, but now it works well.

 

[oldschool]

The new ConfigureDefender ver. 1.0.1.0 is available for testing:

• for Windows 64-bit: AndyFul/ConfigureDefender
• for Windows 32-bit: AndyFul/ConfigureDefender

Added ASR mitigations introduced in Windows ver. 1803 (they should work also on updated ver. 1709).
In the "Child Protection", all ASR mitigations are enabled, with some folder exclusions:
Windows, Program Files ..., ProgramData\Microsoft\Windows Defender.
.
I noticed that mitigation: "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" is more restrictive than Defender 'Cloud Protection Level' set to Block. Furthermore, most executables blocked by this mitigation (but not all) can be run after one day.
.
The mitigation "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" can block some schtaks.exe processes and also processes started by Windows Defender in the folder: ProgramData\Microsoft\Windows Defender.

Post edited.
The Lsass rule, does not support exclusions.

Do you advise downloading this to replace current version - IF NOT testing?

 

[Andy Ful]

Do you advise downloading this to replace current version - IF NOT testing?

Please, wait a few weeks. This version is OK, but there is a little information about how some ASR mitigations work. So, the predefined configs may change after testing.

 

[oldschool]

 

[Andy Ful]

The new ConfigureDefender ver. 1.0.1.1 is available:
for Windows 64-bit: AndyFul/ConfigureDefender
for Windows 32-bit: AndyFul/ConfigureDefender
.
1. Corrected a minor bug related to unnecessary folder exclusion for the ASR mitigation that does not support exclusions.
2. In <Defender high settings> the ASR mitigation 'Use advanced protection against ransomware' is set to ON, and 'Controlled Folder Access' is set to Audit.
.
<Defender high settings> can be adopted by most users.
<Child Protection> is very restrictive due to Controlled Folder Access, hiding the Defender Security Center, and two new mitigations:

• Block executable files from running unless they meet a prevalence, age, or trusted list criteria
• Block credential stealing from the Windows local security authority subsystem (lsass.exe)

The new version was sent to Microsoft and is whitelisted by Defender. It is not whitelisted by SmartScreen, yet. This will take some time.
Be safe.

 

[oldschool]

Patiently waiting for the official release!

Edit: duh!

 

[Andy Ful]

Patiently waiting for the official release!

That was an official release.

 

[Reldel1]

Congrats on the official release. Had been running 1.0.1.0 on two 1803 installs without any issues or events showing in event viewer. Already changed both boxes to new 1.0.1.1 this morning. Using both ConfigureDefender and Hard Configurator have saved much time maintaining Pro versions that I used to configure SRP on myself. Greatly appreciated Andy.

 

[Andy Ful]

Thanks. I will push the new version (4.0.0.0) ) of Hard_Configurator soon with integrated ConfigureDefender. In Hard_Configurator the user can use NirSoft FullEventLogView with the predefined config file to see Windows Defender alerts. I am waiting for whitelisting Hard_Configurator by Avast.

 

[oldschool]

That was an official release.

Thank you for your very kind & patient efforts!

 

[Gandalf_The_Grey]

The new ConfigureDefender ver. 1.0.1.1 is available:
for Windows 64-bit: AndyFul/ConfigureDefender
for Windows 32-bit: AndyFul/ConfigureDefender
.
1. Corrected a minor bug related to unnecessary folder exclusion for the ASR mitigation that does not support exclusions.
2. In <Defender high settings> the ASR mitigation 'Use advanced protection against ransomware' is set to ON, and 'Controlled Folder Access' is set to Audit.
.
<Defender high settings> can be adopted by most users.
<Child Protection> is very restrictive due to Controlled Folder Access, hiding the Defender Security Center, and two new mitigations:

• Block executable files from running unless they meet a prevalence, age, or trusted list criteria
• Block credential stealing from the Windows local security authority subsystem (lsass.exe)

The new version was sent to Microsoft and is whitelisted by Defender. It is not whitelisted by SmartScreen, yet. This will take some time.
Be safe.

Thanks for the update and this great piece of software
What does "Audit" mean?
Do you get a popup?

 

[Andy Ful]

Thanks for the update and this great piece of software
What does "Audit" mean?
Do you get a popup?

'Audit' means that the file will not be blocked (no visible alert), but the info about the possible block (if the setting was Enabled) is written to the Windows Event Log. It helps to find out how safe will be enabling the setting and what the user can expect after enabling it.
Import custom views to see Windows Defender Exploit Guard events
It is convenient to prepare a custom view only for Windows Defender. One can also use NirSoft tool FullEventLogView with the custom config. See the config file in attachment (change the file extension .txt --> .cfg).

 

[Gandalf_The_Grey]

'Audit' means that the file will not be blocked (no visible alert), but the info about the possible block (if the setting was Enabled) is written to the Windows Event Log. It helps to find out how safe will be enabling the setting and what the user can expect after enabling it.
Import custom views to see Windows Defender Exploit Guard events

Okay, thanks for the explanation and the link. I will have a look at it.

 

[Andy Ful]

Okay, thanks for the explanation and the link. I will have a look at it.

I edited my previous post to attach the config file for NirSoft FullEventLogView.

 

[Yellowing]

This is a very nice application! Good work!

Could you please keep the initial post up to date? I was wondering for a while if you switched to a different platform because the link threw 404.
I thought because microsoft bought it or something.

Thanks!

 

[Andy Ful]

Unfortunately, the initial post is locked. Maybe @Jack will unlock it, and then I can keep it updated.

 

[Gandalf_The_Grey]

I edited my previous post to attach the config file for NirSoft FullEventLogView.

Cool, I could find one audited event this way on my laptop
There were others in the past but I had already put them as exclusion for controlled folder access.
Nice tool to play with