ConfigureDefender utility for Windows 10/11

[oldschool]

You will probably see several instances of ConfigureDefender and maybe some other entries of unused/uninstalled applications.

Nada. Nothing. Maybe it is my system configuration ... but it doesn't matter.

 

[Andy Ful]

Nada. Nothing. Maybe it is my system configuration ... but it doesn't matter.

... or some other application (system cleaner) clears the notification area cache fo you.

 

[SeriousHoax]

Tried to run the latest version of WiseVector and got this notification.

Which is alright I guess because WD probably didn't see this file before and the timeout is 60 sec because that's how I set it. Before when I had this timeout notification for other new files, the file always ran after few seconds but not this time. Now even after 30 mins WiseVector is still not running and getting this notification instead.

Maybe a restart will fix it but I'm working on something now so can't do it at the moment. Found a log in temp regarding that timeout notification which is normal I think.

I was wondering if anyone's familiar with this behavior?

 

[oldschool]

Tried to run the latest version of WiseVector and got this notification.

This seems to be a new notification type from M$. I get it with every Brave Nightly update.

Now even after 30 mins WiseVector is still not running and getting this notification instead.

Is WD set to "Block"? That looks like an ASR or H_C block maybe?

 

[CyberTech]

Windows 10 Defender's hidden features revealed by this free tool

Windows 10's built-in Microsoft Defender antivirus solution has many advanced hidden features that allow you to customize how the security software works. Unfortunately, most people do not know these settings exist or even how to access them.

www.bleepingcomputer.com

Wow i cant believe this! we MT are proud of you! congrats @Andy Ful @oldschool @shmu26 you made it

Spoiler: You have to see this

 

[Andy Ful]

Tried to run the latest version of WiseVector and got this notification.
View attachment 240292
Which is alright I guess because WD probably didn't see this file before and the timeout is 60 sec because that's how I set it. Before when I had this timeout notification for other new files, the file always ran after few seconds but not this time. Now even after 30 mins WiseVector is still not running and getting this notification instead.
View attachment 240293
Maybe a restart will fix it but I'm working on something now so can't do it at the moment. Found a log in temp regarding that timeout notification which is normal I think.
View attachment 240296
I was wondering if anyone's familiar with this behavior?

Works well on my machine: H_C (ConfigureDefender HIGH + all ASR rules ON, CFA is ON).

I have got an alert from CFA which blocked WiseVector to access the Documents folder.
Are there any blocks in ConfigureDefender <Defender Security Log>?

 

[SeriousHoax]

Works well on my machine: H_C (ConfigureDefender HIGH + all ASR rules ON, CFA is ON).
View attachment 240298
I have got an alert from CFA which blocked WiseVector to access the Documents folder.
Are there any blocks in ConfigureDefender <Defender Security Log>?

No, nothing is CD log. I'll restart the system later. Probably that will fix the issue.

 

[Andy Ful]

No, nothing is CD log. I'll restart the system later. Probably that will fix the issue.

After looking into ConfigureDefender <Defender Security Log>, I noticed many ASR blocks from Lsass ASR rule. But, WiseVector seems to work without issues and detected some false positives on my machine.

 

[HunterKhajiit]

what is the difference?

Cloud Protection level= highest or block ?=
i dont get it

 

[oldschool]

I noticed many ASR blocks from Lsass ASR rule. But, WiseVector seems to work without issues

I did the same here not long ago.

what is the difference?

Cloud Protection level= highest or block ?=
i dont get it

"Block" is more aggressive with more FPs.

 

[Andy Ful]

what is the difference?

Cloud Protection level= highest or block ?=
i dont get it

The second should be more aggressive. But, there are no details available (no documentation). From the tests on MH and my tests, the Block level does not block all unknown executables. It probably can block sufficiently suspicious & unknown files.

 

[oldschool]

But, there are no details available (no documentation)

I did see something from M$, but I don't remember where ...

 

[Andy Ful]

I did see something from M$, but I don't remember where ...

The something you saw, is probably a short description like the below:

Specify the cloud protection level for Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Set your level of cloud protection for Microsoft Defender Antivirus.

docs.microsoft.com

 

[oldschool]

The something you saw, is probably a short description like the below:

Specify the cloud protection level for Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Set your level of cloud protection for Microsoft Defender Antivirus.

docs.microsoft.com

Yes, but also somewhere it mentioned more FPs and is not advised.

 

[Andy Ful]

Yes, but also somewhere it mentioned more FPs and is not advised.

It can be deduced from the description = block unknown executables.
It is also obvious when one looks at the sequence:
Default >> High >> High+ >> Block.
I am trying to find something more informative for 2 years without any success.

 

[Vitali Ortzi]

It can be deduced from the description = block unknown executables.
It is also obvious when one looks at the sequence:
Default >> High >> High+ >> Block.
I am trying to find something more informative for 2 years without any success.

Configure Defender is a very great tool made me come back to built in protection in some Configuration.
Unfortunately it's not up to Andy to lower the false positive rate .
Even default has false positives for some Users ,me as well(used to have in a few programs in my USB but replaced them with powershell/Bat scripts Wich fixed the issue and saved me space as well).

 

[oldschool]

I am trying to find something more informative for 2 years without any success.

Probably longer ...

 

[bayasdev]

Probably longer ...

probably when Windows ceases to exists as it is

 

[Protomartyr]

I've been recommending ConfigureDefender on the BleepingComputer forums. Glad to see you're getting recognition for the phenomenal work that you do!

 

[simmerskool]

Tried to run the latest version of WiseVector and got this notification.
View attachment 240292
Which is alright I guess because WD probably didn't see this file before and the timeout is 60 sec because that's how I set it. Before when I had this timeout notification for other new files, the file always ran after few seconds but not this time. Now even after 30 mins WiseVector is still not running and getting this notification instead.
View attachment 240293
Maybe a restart will fix it but I'm working on something now so can't do it at the moment. Found a log in temp regarding that timeout notification which is normal I think.
View attachment 240296
I was wondering if anyone's familiar with this behavior?

Yes I saw this or very similar the other day, when I was bored and tried to run an eset online scan of win10. H_C using default recommended settings for SRP, CD & firewall. Running as SUA. I assumed the block was H_C related, but I didn't really care about running eset scan, so I forgot about it.