ConfigureDefender utility for Windows 10/11

[ErzCrz]

FWH rules cannot be seen by WFC FYI

Thanks and yeah, hence why they can be over ruled by WFC. I did and one point make and try and manually add them into WFC but it was tedious and gave up half way through. Might have another go at some point but we'll see. Just questioning if WFC is needed.

 

[Andy Ful]

Thanks and yeah, hence why they can be over ruled by WFC. I did and one point make and try and manually add them into WFC but it was tedious and gave up half way through. Might have another go at some point but we'll see. Just questioning if WFC is needed.

If you did 1/2 then it is worth finishing your work. Maintaining one app is simpler than two.

 

[sypqys]

Hi !

@Andy Ful

Since ransomware protection is recommended to be disabled in CD, do you recommend using OSArmor to overcome this?
Since I don't use H_C but the ConfigureDefender and FirewallHardening tools...

 

[Andy Ful]

Hi !

@Andy Ful

Since ransomware protection is recommended to be disabled in CD,

That is not what I wrote in the ConfigureDefender help:

CFA can be very useful as anti-ransomware protection, but only after excluding the applications that need to access protected folders and applications that need to access protected disk sectors. The second group can include backup applications, disk management applications, disk optimization programs, etc. It is recommended to set initially this rule to Audit.

I recommend disabling CFA when users want to avoid exclusions and false positive alerts (which is true for most users). Anyway, ConfigureDefender HIGH settings include some anti-ransomware prevention by increasing the Cloud Protection Level and applying ASR rules.

... do you recommend using OSArmor to overcome this?

I cannot recommend OSA for the same reasons as for CFA.
Of course, if one can accept false positives, then CFA or OSA can be used. However, OSA is not software for everyone (similarly to H_C) and might require special configuration to help prevent ransomware.

Edit.
I moved your post from the H_C thread to the ConfigureDefender thread because you do not use H_C.

 

[sypqys]

That is not what I wrote in the ConfigureDefender help:


I recommend disabling CFA when users want to avoid exclusions and false positive alerts (which is true for most users). Anyway, ConfigureDefender HIGH settings include some anti-ransomware prevention by increasing the Cloud Protection Level and applying ASR rules.



I cannot recommend OSA for the same reasons as for CFA.
Of course, if one can accept false positives, then CFA or OSA can be used. However, OSA is not software for everyone (similarly to H_C) and might require special configuration to help prevent ransomware.

Edit.
I moved your post from the H_C thread to the ConfigureDefender thread because you do not use H_C.

Sorry again, and many thanks for the help here