ConfigureDefender utility for Windows 10/11

[Andy Ful]

@Andy Ful Are there any differences in protection between Windows 10 or 11 Home and Pro editions when using ConfigureDefender?

No (as far as I know).

 

[tsunami]

Win11 has additional security features like Smart App Control, Enhanced phishing protection etc.

 

[Andy Ful]

Windows 11 has implemented several new security features, so: Windows 11 + ConfigureDefender > Windows 10 + ConfigureDefender
But, the advantage does not follow in any way from using ConfigureDefender.

 

[ForgottenSeer 100397]

@Andy Ful Does Block Executable Files or Advanced Ransomware Protection stop .tmp files from running even when you click Unblock?

 

[Andy Ful]

@Andy Ful Does Block Executable Files or Advanced Ransomware Protection stop .tmp files from running even when you click Unblock?

Yes, it should.

 

[ForgottenSeer 100397]

@Andy Ful Can I safely delete the logs in CD's Defender Security Log?

 

[oldschool]

@Andy Ful Can I safely delete the logs in CD's Defender Security Log?

I believe it will repopulate whatever you delete.

 

[Andy Ful]

@Andy Ful Can I safely delete the logs in CD's Defender Security Log?

Yes and No.
You cannot do it via ConfigureDefender (the CD Log file is created each time from Windows Event Log).
You can clear the Windows Defender from Event Viewer:

https://malwaretips.com/threads/man...oft-defender-in-windows-11.112970/post-980982

But, I do not think that this is necessary. The events in the CD Log are sorted by time, so the new events are easily visible.

 

[ForgottenSeer 100397]

Post updated.

If one wants to clear the Defender History or solve the problem with crashing Defender History there is a simple solution.

1. Download the AdvancedRun:
   for Windows 32-bit: https://www.nirsoft.net/utils/advancedrun.zip
   for Windows 64-bit: https://www.nirsoft.net/utils/advancedrun-x64.zip
2. Run AdvancedRun.exe once and close it - the file AdvancedRun.cfg will be created
3. Edit the config file AdvancedRun.cfg as it is shown below
4. Disable Defender Tamper protection >> Run AdvancedRun.exe to clear the Defender History >> Enable Tamper Protection.

After running AdvancedRun it will automatically apply the settings and command lines from the AdvancedRun.cfg and the Defender History will be cleared.

The modified content of AdvancedRun.cfg is as follows:

...
EXEFilename=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine=net stop windefend; $path = 'c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db'; if (Test-Path -Path $path) {Remove-Item $path}; $path = 'c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory'; if (Test-Path -Path $path) {Remove-Item $path -Recurse}; net start windefend
AutoRun=1
...
RunAs=8
...

The PowerShell is executed with CommandLine.
AutoRun=1 means that AdvancedRun does not show the application window and automatically applies the AdvancedRun.cfg
RunAs=8 means that the process will be run with TrustedInstaller privileges.

The CommandLine simply stops Windefend service, checks if the file/folder exists and deletes it, starts Windefend service again.

I tried all the steps mentioned on Page 68 to clear Protection History on my fully updated Win 11 system, but nothing seems to work. You can't remove the mpenginedb.db file or clear the Protection History even if you delete the Service folder in Safe Mode. All the detections are still showing up. When I tried the quoted steps, I received an Error: 1058. However, PowerShell works fine when I start it manually. There is no third-party security software, optimizer, or scripts used on my system.

 

[Andy Ful]

I tried all the steps mentioned on Page 68 to clear Protection History on my fully updated Win 11 system, but nothing seems to work.

Microsoft blocked that method one year ago:

ConfigureDefender utility for Windows 10/11

protection history intented to keep history by purpose It should give an option to delete those on purpose too. That's what almost all other security products do. The protection history is also known to crash randomly or when there's a lot of entry. no try yourself let others do your work for...

malwaretips.com

 

[ForgottenSeer 100397]

They discontinued DefenderControl, right? You can only find it by searching on Sordum. I disabled MD using DC and then successfully deleted the .db file and DetectionHistory folder, which cleared Protection History. By using DefenderControl to disable Defender, I also hope to prevent Defender updates via Windows Updates.

 

[Digmor Crusher]

Event[0]:
Time Created : 2023-11-20 7:30:21 AM
ProviderName : Microsoft-Windows-Windows Defender
Id : 5001
Message : Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.

Andy, just wondering why I would get this event everyday when starting computer?
Additional Info: Running CD on High setting, alongside Cyberlock, I have also stopped the scheduled Defender scans in Task Scheduler.
Thanks.

 

[oldschool]

Event[0]:
Time Created : 2023-11-20 7:30:21 AM
ProviderName : Microsoft-Windows-Windows Defender
Id : 5001
Message : Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.

Andy, just wondering why I would get this event everyday when starting computer?
Additional Info: Running CD on High setting, alongside Cyberlock, I have also stopped the scheduled Defender scans in Task Scheduler.
Thanks.

Check VS logs for a possible answer. Either that or possibly because you disabled scanning in TS.

 

[Digmor Crusher]

This Cyberlock log item occurs at the same time as the Defender event. It may be possible they both occurred at the same time as that's the time I powered on my computer. I'm thinking event is because I did cancel scanning.

 

[Freki123]

Command Line log (in CL) is also clear with no related block?
I can't remember I ever had a scan blocked in CD or HC. Even on HC max with nearly all stuff actived in SRP.

 

[oldschool]

View attachment 279810
This Cyberlock log item occurs at the same time as the Defender event. It may be possible they both occurred at the same time as that's the time I powered on my computer. I'm thinking event is because I did cancel scanning.

Did you check VS developer.log.log in program data?

 

[Digmor Crusher]

Command Line log (in CL) is also clear with no related block?
I can't remember I ever had a scan blocked in CD or HC. Even on HC max with nearly all stuff actived in SRP.

There are about 20 command lines shown and all of them are "Allowed" if that means anything.

 

[Digmor Crusher]

Did you check VS developer.log.log in program data?

Had a look but I have no idea what these logs mean. But thanks for the idea. Unless Andy knows what's going on I'll have to try to figure it out by uninstalling Cyberlock and/or allowing Defender scanning again.

 

[Andy Ful]

Event[0]:
Time Created : 2023-11-20 7:30:21 AM
ProviderName : Microsoft-Windows-Windows Defender
Id : 5001
Message : Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.

Andy, just wondering why I would get this event everyday when starting computer?
Additional Info: Running CD on High setting, alongside Cyberlock, I have also stopped the scheduled Defender scans in Task Scheduler.
Thanks.

I can sometimes see such alerts. I think that they are related to the Defender updates. If so then this event should be followed by another event about enabling Real-time protection. But, I am not sure why you have this event every day when starting the computer.
In the H_C < Blocked Events / Security Logs >, the event 5001 is skipped. It is present only in the CD Log.

 

[Digmor Crusher]

I thought it may have something to do with Defender updates also as the Cyberlock log shows Windows downloading and installing a delta patch at the same time as the CD event. I've changed the setting in Task scheduler to allow the scan and no change, I still get the Defender event. I get this popup when starting the computer, not sure why it says I'm using another av program.