ConfigureDefender utility for Windows 10/11

[badboy]

I'm add Lolbins and recommended H_C. And turn on logging events. It's enough?

 

[oldschool]

I'm add Lolbins and recommended H_C. And turn on logging events. It's enough?

Yes.

 

[simmerskool]

@Andy Ful without me reading all 91 pages of posts... (I normally use danb's DefenderUI but on this VM I only use MSD and your tools), and my Defender systray icon has a yellow flag and it says Tamper Protection is Off. I assume I ran ConfigureDefender at default (or max or recommended) so should Tamper protection be off. should I just turn it ON from system Windows Security, or open ConfigureDefender and run it again? ie, is it normal for Tamper to be off after running CD?

 

[Andy Ful]

I assume I ran ConfigureDefender at default (or max or recommended) so should Tamper protection be off. should I just turn it ON from system Windows Security, or open ConfigureDefender and run it again? ie, is it normal for Tamper to be off after running CD?

ConfigureDefender does not change Tamper Protection. If I recall correctly DefenderUI does.
You should turn ON Tamper Protection.

 

[simmerskool]

ConfigureDefender does not change Tamper Protection. If I recall correctly DefenderUI does.
You should turn ON Tamper Protection.

Thanks & done!!

 

[Andy Ful]

It looks like ConfigureDefender can also be downloaded from the WinGet repository:

Install ConfigureDefender with winget - winstall

Utility for configuring Windows 10 built-in Defender antivirus settings.

winstall.app

WinGet installs ConfigureDefender into the directory:
%LocalAppData%\Microsoft\WinGet\Packages\AndyFul.ConfigureDefender_Microsoft.Winget.Source_8wekyb3d8bbwe

WinGet adds this directory to the PATH environment variable, so ConfigureDefender can be executed from anywhere by invoking the configuredefender variable (similarly to system executables).

 

[rashmi]

Does the Cloud Protection Level or "Block executables..." use the ISG or SmartScreen backend?

 

[Andy Ful]

Does the Cloud Protection Level or "Block executables..." use the ISG or SmartScreen backend?

It is possible that the "Block executables..." ASR rule somehow depends on "ISG without a SmartScreen backend (files with no MOTW)". But this rule also depends on the file age. If the file is known in the Microsoft cloud for more than 24 hours, it will be allowed even if ISG still blocks it.

There is no direct connection to SmartScreen. Both Cloud Protection Level and "Block executables..." ASR rule can block executables allowed by SmartScreen. For example, the ASR rule blocked my digitally signed applications a few times (allowed by SmartScreen).

Edit.
The ASR rule "Block executables ..." does not block MSI files and DLLs loaded by EXEs (cannot prevent DLL hijacking), but SAC (and WDAC ISG) can.
When protecting happy clickers with an enabled rule "Block executables ...", enabling also SAC makes sense.