ConfigureDefender utility for Windows 10/11

[Digmor Crusher]

@rashmi probably posted about Microsoft Defender.

I was sort of thinking that too but figured I would reply anyways.

 

[rashmi]

I did not notice that Microsoft Defender received updates solely through Windows Updates.
Most frequent updates are received via MAPS independently of Windows Updates:

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

learn.microsoft.com

In addition to MAPS, Defender updates are also received via Windows Updates:

• Security Intelligence Update (KB2267602)
• Antivirus antimalware platform (KB4052623)
• Malicious Software Removal Tool x64 (KB890830)

Does Defender function properly or fully if you disable Windows Update?

With Configure Defender set to "high" and "block executables" enabled, would you recommend any of your tools for managed average users?

 

[Andy Ful]

Does Defender function properly or fully if you disable Windows Update?

I do not know (no one tested this).

With Configure Defender set to "high" and "block executables" enabled, would you recommend any of your tools for managed average users?

I do not recommend my tools to average users. But, they can be used by "home administrators" to protect the computers of average users. The 'home administrator" must decide which tools should be used. More tools = more security = more work for the "home administrator".
The minimum setup balanced both for security and usability would be as follows:
Microsoft Defender with ConfigureDefender HIGH Protection Level + FirewallHardening (H_C Recommended blockList) + Edge web browser (SmartScreen + PUA) + SmartScreen for Explorer.

Such a setup could be probably OK also for many MT members. If the average user ignores SmartScreen, it should be set to Block in ConfigureDefender.

 

[sypqys]

I do not know (no one tested this).



I do not recommend my tools to average users. But, they can be used by "home administrators" to protect the computers of average users. The 'home administrator" must decide which tools should be used. More tools = more security = more work for the "home administrator".
The minimum setup balanced both for security and usability would be as follows:
Microsoft Defender with ConfigureDefender HIGH Protection Level + FirewallHardening (H_C Recommended blockList) + Edge web browser (SmartScreen + PUA) + SmartScreen for Explorer.

Such a setup could be probably OK also for many MT members. If the average user ignores SmartScreen, it should be set to Block in ConfigureDefender.

When you said SmartScreen for Explorer, it put on Block or User ?

 

[Andy Ful]

When you said SmartScreen for Explorer, it put on Block or User ?

Block, if the average user ignores SmartScreen.

 

[sypqys]

why Controlled Folder Access on Disabled with high recommendations ?

 

[Andy Ful]

why Controlled Folder Access on Disabled with high recommendations ?

Too many false positives.

 

[rashmi]

I do not know (no one tested this).



I do not recommend my tools to average users. But, they can be used by "home administrators" to protect the computers of average users. The 'home administrator" must decide which tools should be used. More tools = more security = more work for the "home administrator".
The minimum setup balanced both for security and usability would be as follows:
Microsoft Defender with ConfigureDefender HIGH Protection Level + FirewallHardening (H_C Recommended blockList) + Edge web browser (SmartScreen + PUA) + SmartScreen for Explorer.

Such a setup could be probably OK also for many MT members. If the average user ignores SmartScreen, it should be set to Block in ConfigureDefender.

I'm currently testing CD and exploring Firewall Hardening. I downloaded the Firewall Hardening package, which includes Firewall Hardening and additional tools. Can I delete the extra tools and rename the folder as Firewall Hardening? Are you suggesting that I enable only H_C Recommended BlockList in Firewall Hardening for a balanced level of protection? The screenshots in the first post showcase the configuration for "child protection" in Configure Defender. Have you removed it?

 

[Andy Ful]

I'm currently testing CD and exploring Firewall Hardening. I downloaded the Firewall Hardening package, which includes Firewall Hardening and additional tools. Can I delete the extra tools and rename the folder as Firewall Hardening?

Yes.

Are you suggesting that I enable only H_C Recommended BlockList in Firewall Hardening for a balanced level of protection?

Yes.

The screenshots in the first post showcase the configuration for "child protection" in Configure Defender. Have you removed it?

The screenshots are not related to any predefined setup. When protecting children the recommended starting setup is MAX Protection Level with some modifications if necessary.

 

[rashmi]

@Andy Ful Do you receive Configure Defender and Firewall Hardening alerts for blocked events? How effective is Smart Screen's whitelist or whatever it has? Is Firewall Hardening (H_C Recommended BlockList) safe or trouble-free? Any suggestions for it?

 

[Andy Ful]

@Andy Ful Do you receive Configure Defender and Firewall Hardening alerts for blocked events?

Very rarely and can be ignored.

How effective is Smart Screen's whitelist or whatever it has?

SmartScreen for Explorer is enabled by default on Windows. So, you can see by yourself how many alerts were/are triggered on your computer. The SmartScreen whitelist is managed only by Microsoft.

Is Firewall Hardening (H_C Recommended BlockList) safe or trouble-free? Any suggestions for it?

Mostly yes. You can look at the <Blocked Events> to see how it works on your computer.
Please, post about FirewallHardening in the dedicated thread:

FirewallHardening tool

FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone application among a few others included in the H_C_HardeningTools repository...

malwaretips.com

 

[rashmi]

@Andy Ful Is it okay if I combine "Configure Defender" and "Firewall Hardening" in one folder, renaming it to "Hard Configurator" or "Andy Ful tools"? Microsoft Copilot states that Defender relies solely on Windows Update for its security intelligence and product updates.

 

[Andy Ful]

@Andy Ful Is it okay if I combine "Configure Defender" and "Firewall Hardening" in one folder, renaming it to "Hard Configurator" or "Andy Ful tools"?

Yes.

 

[ErzCrz]

With me running CyberLock, I;m looking at using ConfigureDefender but where's a suggested place to run it from? I know running H_C along with CL is potential overkill but I also like that it's installed and CD and FWH accessible through it's UI but maybe running both is possible hmm.

 

[oldschool]

CD and FWH accessible through it's UI but maybe running both is possible hmm.

You can copy those executables anywhere you like, pin them to Start, Taskbar, etc. You can delete the rest of the HC folder's contents if you're not planning on using them. Users can also download CD and FWH executables separately from @Andy Ful's GitHub page.

 

[Andy Ful]

With me running CyberLock, I;m looking at using ConfigureDefender but where's a suggested place to run it from? I know running H_C along with CL is potential overkill but I also like that it's installed and CD and FWH accessible through it's UI but maybe running both is possible hmm.

I do not use/test CyberLock so I do not know if applying ConfigureDefender and FirewallHardening would be OK.
Anyway, Those tools have portable versions:

FirewallHardening tool

FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone application among a few others included in the H_C_HardeningTools repository...

malwaretips.com

 

[ErzCrz]

I do not use/test CyberLock so I do not know if applying ConfigureDefender and FirewallHardening would be OK.
Anyway, Those tools have portable versions:

FirewallHardening tool

FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone application among a few others included in the H_C_HardeningTools repository...

malwaretips.com

You can copy those executables anywhere you like, pin them to Start, Taskbar, etc. You can delete the rest of the HC folder's contents if you're not planning on using them. Users can also download CD and FWH executables separately from @Andy Ful's GitHub page.

Thanks both. Just testing them out as a possible option.

 

[Digmor Crusher]

I do not use/test CyberLock so I do not know if applying ConfigureDefender and FirewallHardening would be OK.

I've tried it, no problems.

 

[ErzCrz]

I've tried it, no problems.

Good to know! CL does show a cmd alert when opening CD but easy enough to allow. FWH rules can be overridden by WFC which I'm also using though debating if WFC is needed with WFH and CL set to create block rules for unsafe files.

 

[1chaoticadult]

Good to know! CL does show a cmd alert when opening CD but easy enough to allow. FWH rules can be overridden by WFC which I'm also using though debating if WFC is needed with WFH and CL set to create block rules for unsafe files.

FH rules cannot be seen by WFC FYI. The FH rules override WFC rules. Andy Ful has stated this before.