ConfigureDefender utility for Windows 10/11

[oldschool]

Been thinking of swapping over to CD from DefenderUI.

I don't see the point of the latter.

 

[ErzCrz]

I don't see the point of the latter.

I'm using CD over DefenderUI because its one less program to install, even though they both pretty much do the same thing.

Thanks both

 

[South Park]

I keep getting this block now Andy, anything to worry about? I assume its because I'm using the Interactive setting? Thanks.

Event[0]:
Time Created : 2024-10-25 7:46:09 AM
ProviderName : Microsoft-Windows-Windows Defender
Id : 1121
Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
For more information please contact your IT administrator.
ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Detection time: 2024-10-25T12:46:09.878Z
User: NT AUTHORITY\SYSTEM
Path: C:\Windows\System32\taskhostw.exe
Process Name: C:\Windows\System32\lsass.exe
Target Commandline: taskhostw.exe -RegisterDevice -SettingChange
Parent Commandline:
Involved File:
Inheritance Flags: 0x00000000
Security intelligence Version: 1.419.704.0
Engine Version: 1.1.24080.9
Product Version: 4.18.24080.9

FWIW, I also use Interactive mode and I've started getting these warnings today (5x so far) for no apparent reason. I don't recall ever seeing this warning before. W10, fully patched. I'm guessing it could be a bug on MS end.

 

[oldschool]

@South Park see post #1697

In the HIGH Protection Level this ASR rule is disabled because the block is triggered for many benign applications that try to enumerate running processes and attempt to open them with exhaustive permissions. In your case, some service based on DLL tries to change settings.

 

[Andy Ful]

FWIW, I also use Interactive mode and I've started getting these warnings today (5x so far) for no apparent reason. I don't recall ever seeing this warning before. W10, fully patched. I'm guessing it could be a bug on MS end.

Did you install recently some new applications or Windows updates?
You have the same event (CmdLine: taskhostw.exe -RegisterDevice -SettingChange) as @Digmor Crusher, so either you shared the same malware or it is a false positive.

 

[South Park]

Did you install recently some new applications or Windows updates?
You have the same event (CmdLine: taskhostw.exe -RegisterDevice -SettingChange) as @Digmor Crusher, so either you shared the same malware or it is a false positive.

The only thing I had installed recently was a digitally signed font (Newsreader) with SHA-256 of 8a08d13f8a6c0d51be379a60af84f945f65369a67e509ee3c3bdcc421254d7c1 and 796668611f80b64d5adf182fde3b6f29ed83b4e7cbec7b96937e84ac01364792 (both OK on Virus Total). I ran the offline Defender scan which reported nothing. I uninstalled the font anyway but am still getting this message: Event[0]: Time Created : 10/26/2024 1:08:22 PM ProviderName : Microsoft-Windows-Windows Defender Id : 1121 Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe) Detection time: 2024-10-26T20:08:22.542Z User: NT AUTHORITY\SYSTEM Path: C:\Windows\System32\svchost.exe Process Name: C:\Windows\System32\lsass.exe Target Commandline: Parent Commandline: Involved File: Inheritance Flags: 0x00000000 Security intelligence Version: 1.419.722.0 Engine Version: 1.1.24080.9 Product Version: 4.18.24080.9

 

[Digmor Crusher]

I switched my protection level from "Interactive" to "High" and haven't gotten that block since so it must be a rule that's doing it.

 

[Andy Ful]

The only thing I had installed recently was a digitally signed font (Newsreader) with SHA-256 of 8a08d13f8a6c0d51be379a60af84f945f65369a67e509ee3c3bdcc421254d7c1 and 796668611f80b64d5adf182fde3b6f29ed83b4e7cbec7b96937e84ac01364792 (both OK on Virus Total). I ran the offline Defender scan which reported nothing. I uninstalled the font anyway but am still getting this message: Event[0]: Time Created : 10/26/2024 1:08:22 PM ProviderName : Microsoft-Windows-Windows Defender Id : 1121 Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe) Detection time: 2024-10-26T20:08:22.542Z User: NT AUTHORITY\SYSTEM Path: C:\Windows\System32\svchost.exe Process Name: C:\Windows\System32\lsass.exe Target Commandline: Parent Commandline: Involved File: Inheritance Flags: 0x00000000 Security intelligence Version: 1.419.722.0 Engine Version: 1.1.24080.9 Product Version: 4.18.24080.9

This one is different, but there is no need to worry. Such events are common. The practical solution is to ignore them.

 

[South Park]

Interestingly, I haven't noticed any more errors after uninstalling the font and restarting Windows. It might be a coincidence, or maybe the Windows font manager was doing something weird.

ETA: it just happened again, so the font probably wasn't the problem

This one is different, but there is no need to worry. Such events are common. The practical solution is to ignore them.

 

[Can't Decide]

Event[0]:
Time Created : 10/26/2024 1:08:22 PM
ProviderName : Microsoft-Windows-Windows Defender
Id : 1121
Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
For more information please contact your IT administrator.
ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Detection time: 2024-10-26T20:08:22.542Z
User: NT AUTHORITY\SYSTEM
Path: C:\Windows\System32\svchost.exe
Process Name: C:\Windows\System32\lsass.exe
Target Commandline:
Parent Commandline:
Involved File:
Inheritance Flags: 0x00000000
Security intelligence Version: 1.419.722.0
Engine Version: 1.1.24080.9
Product Version: 4.18.24080.9

Few month ago I don't think it have this message, only recently I noticed I also had this message whenever I turn on my pc and reached desktop screen about the same time as the detection time, is it also same for you? @South Park


@Andy Ful, is it still under the events are common and there is nothing to worry. The practical solution is to ignore them?
I did not install any new program.

 

[Andy Ful]

@Andy Ful, is it still under the events are common and there is nothing to worry. The practical solution is to ignore them?
I did not install any new program.

Yes.

 

[oldschool]

Few month ago I don't think it have this message, only recently I noticed I also had this message whenever I turn on my pc and reached desktop screen about the same time as the detection time,

Quite often these blocks will not impact app performance and can be ignored. OTOH, if the app isn't functioning then you may need to disable this rule, since exceptions are not allowed.

 

[Can't Decide]

Yes.

Thank you for clarify for me.

Quite often these blocks will not impact app performance and can be ignored. OTOH, if the app isn't functioning then you may need to disable this rule, since exceptions are not allowed.

Noted.

For now, I didn't know notice any impact since I don't know what service using svchost.exe that cause the blocks. Without knowing what service trigger it and few months ago didn't have any of these blocks is making me anxiety.

I know lots of services using svchost.exe but is there a way to check which service using svchost.exe that cause the blocks?

 

[oldschool]

I know lots of services using svchost.exe but is there a way to check which service using svchost.exe that cause the blocks?

I'm not sure because so many apps and services use svchost.exe, but you may want to check with Process Explorer or Process Hacker.

 

[simmerskool]

I know lots of services using svchost.exe but is there a way to check which service using svchost.exe that cause the blocks?

look for command line flag

View the List of Services Hosted by the svchost.exe Process in Windows

Svchost.exe is a process that hosts other Windows services that perform various system functions. There can be multiple instances of svchost.exe running on your computer, with each instance containing a different service. We published a post a while back on what you can do if svchost.exe is...

helpdeskgeek.com

 

[South Park]

Few month ago I don't think it have this message, only recently I noticed I also had this message whenever I turn on my pc and reached desktop screen about the same time as the detection time, is it also same for you? @South Park


@Andy Ful, is it still under the events are common and there is nothing to worry. The practical solution is to ignore them?
I did not install any new program.

I also was receiving at least one notification at computer start-up, and often one when starting Firefox. I ended up setting the rule to block rather than to warn and haven't noticed any problems, though almost all of my software is open-source portable apps or a few select portable freeware apps.

 

[rashmi]

@Andy Ful Does Defender continue to receive updates solely through Windows Update, or can it now update on its own?

 

[Digmor Crusher]

As far as I know it only updates when Andy tweaks an existing version or makes a newer version , it does not update regularly like an AV does.

 

[Andy Ful]

As far as I know it only updates when Andy tweaks an existing version or makes a newer version , it does not update regularly like an AV does.

@rashmi probably posted about Microsoft Defender.

 

[Andy Ful]

@Andy Ful Does Defender continue to receive updates solely through Windows Update, or can it now update on its own?

I did not notice that Microsoft Defender received updates solely through Windows Updates.
Most frequent updates are received via MAPS independently of Windows Updates:

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

learn.microsoft.com

In addition to MAPS, Defender updates are also received via Windows Updates:

• Security Intelligence Update (KB2267602)
• Antivirus antimalware platform (KB4052623)
• Malicious Software Removal Tool x64 (KB890830)