ConfigureDefender utility for Windows 10/11

[Andy Ful]

Configuredefender ver. 3.1.1.1

Installer:

https://github.com/AndyFul/ConfigureDefender/raw/master/ConfigureDefender.exe

Help (updated):

https://github.com/AndyFul/ConfigureDefender/raw/master/ConfigureDefenderHelp.pdf

No need to update the installer (only a new certificate added, no functional changes).

 

[SeriousHoax]

Configuredefender ver. 3.1.1.1

In the app, the version number still shows: 3.0.1.1

 

[Andy Ful]

In the app, the version number still shows: 3.0.1.1
View attachment 267970

Yes. I used the executables from ver. 3.0.1.1 and added the new certificate to them.
So, the code in versions 3.1.1.1 and 3.0.1.1 is identical, only file hashes are different.
The ConfigureDefender version is hardcoded in the executables, so it is still visible as 3.0.1.1.

 

[Kongo]

Yes. I used the executables from ver. 3.0.1.1 and added the new certificate to them.
So, the code in versions 3.1.1.1 and 3.0.1.1 is identical, only file hashes are different.
The ConfigureDefender version is hardcoded in the executables, so it is still visible as 3.0.1.1.

New version is detected by Sophos as ML PUA. What's causing this if you only added a new certificate?

 

[Andy Ful]

New version is detected by Sophos as ML PUA. What's causing this if you only added a new certificate?

View attachment 267973

Sophos probably detects by ML all new ConfigureDefender versions as PUA, until it removes the false positive detection. The new ConfigureDefender files are also new to Sophos (different file hashes).
I submit my executables for whitelisting only to Microsoft, Avast, Bitdefender, and Norton.

 

[Kongo]

Sophos probably detects by ML all new ConfigureDefender versions as PUA, until it removes the false positive detection. The new ConfigureDefender files are also new to Sophos (different file hashes).
I submit my executables for whitelisting only to Microsoft, Avast, Bitdefender, and Norton.

Submitted it as a FP but it will probably take a while as Sophos is quite slow at whitelisting

 

[Andy Ful]

Andy,

I just tried the app. It works great! Good work. What made you start the project?

ConfigureDefender is a part of the Hard_Configurator project (long story).

 

[Andy Ful]

How NOT to make tests with ConfigureDefender.



The author did not read the ConfigureDefender help:

How to apply the settings.
Select a Protection Level or custom configuration, press the "Refresh" green button and let ConfigureDefender confirm the changes. ConfigureDefender will alert if any of your changes have been blocked. Reboot to apply chosen protection.

Without rebooting, most of the MAX settings were not applied which is also visible in this video.

 

[eonline]

I also have a problem I can't see the native Windows protection history because it closes automatically.

 

[Andy Ful]

I also have a problem I can't see the native Windows protection history because it closes automatically.

You can use <Defender Security Log> in ConfigureDefender.

 

[oldschool]

I also have a problem I can't see the native Windows protection history because it closes automatically.

It is crashing due to a longtime bug in Defender. Try clearing protection history.

 

[Andy Ful]

It is crashing due to a longtime bug in Defender. Try clearing protection history.

It is not easy because of Tamper Protection. The events related to ASR rules and CFA require a complex treatment. There are some ways to do it, we talk about this on this thread here:

ConfigureDefender utility for Windows 10/11

protection history intented to keep history by purpose It should give an option to delete those on purpose too. That's what almost all other security products do. The protection history is also known to crash randomly or when there's a lot of entry. no try yourself let others do your work for...

malwaretips.com

 

[oldschool]

It is not easy because of Tamper Protection. The events related to ASR rules and CFA require a complex treatment. There are some ways to do it, we talk about this on this thread here:

ConfigureDefender utility for Windows 10/11

protection history intented to keep history by purpose It should give an option to delete those on purpose too. That's what almost all other security products do. The protection history is also known to crash randomly or when there's a lot of entry. no try yourself let others do your work for...

malwaretips.com

Yes, I'm aware of that thread.

@Emanuel Tomasin One way around this is to reduce length of time to keep Protection History before auto-clearing either in GPO or via powershell.

 

[Andy Ful]

Yes, I'm aware of that thread.

@Emanuel Tomasin One way around this is to reduce length of time to keep Protection History before auto-clearing either in GPO or via powershell.

The last time when I tested this setting it could not clear the advanced blocks. Reducing the time of keeping Protection History could clear the same entries as deleting manually the folder:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory
This can be done easily via PowerShell with Administrator privileges:

del "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory"

I posted to Microsoft about this issue, but I did not test if it was solved.

 

[SeriousHoax]

Interesting changelog in the release preview channel build of Windows 11.

• New! We enhanced Microsoft Defender for Endpoint’s ability to identify and intercept ransomware and advanced attacks.

I'm guessing this improvement is even coming to the stock Microsoft Defender. Maybe it has some similarity to the advanced ransomware ASR rule.

 

[Azure]

How NOT to make tests with ConfigureDefender.



The author did not read the ConfigureDefender help:



Without rebooting, most of the MAX settings were not applied which is also visible in this video.

They released a new video comparison

 

[oldschool]

Interesting changelog in the release preview channel build of Windows 11.

I'm guessing this improvement is even coming to the stock Microsoft Defender. Maybe it has some similarity to the advanced ransomware ASR rule.

Maybe they're implementing that ASR rule knowing it is stable and suitable for the average user, i.e. it won't throw FPs.

 

[eonline]

Hi Andy C_D works correctly on windows 11 22h2?

 

[oldschool]

Hi Andy C_D works correctly on windows 11 22h2?

Yes. It configures settings via powershell, or users may configure Defender manually via PS commands without ConfigureDefender.

 

[Andy Ful]

Hi Andy C_D works correctly on windows 11 22h2?

Yes.