ConfigureDefender utility for Windows 10

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Tried that, and I checked Get-MpPreference and see Network Protection enabled. Same result and still no notification. No matter, I have Traffic Light installed on Brave.:barefoot::barefoot::barefoot:
I tested how works the Defender Control tool. It writes one policy key to disable WD and stops two Defender services:
  • Windows Defender Antivirus Network Inspection Service (WdNisSvc);
  • Windows Defender Antivirus Service (WinDefend);
The interesting thing is that after disabling WD by Defender Control tool, the WD Network protection still works on my test machine (tested on Windows 10 Home ver. 1903), even after restarting Windows. But, the blocked events are not logged. This is not what follows from Microsoft documentation for Network Protection:

Windows 10 versionWindows Defender Antivirus
Windows 10 version 1709 or laterWindows Defender AV real-time protection and cloud-delivered protection must be enabled

This topic will require some additional research.(y)
 

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Ha, Ha. I am really stupid. :oops:
Although WD was disabled in Virtual Machine, the web browser connection from Virtual Machine was in fact disabled by WD in the real system. I checked it by ConfigureDefender logs in Virtual Machine (no blocked event in the log) and in the real system (blocked event in the log).
Simply, my Virtual Machine is configured to use the Internet connection of the real system (default settings in Virtual Box ---> Connected to: NAT). So, I have to test it in the real system, or change the settings of VM.
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,150
Ha, Ha. I am really stupid. :oops:
Although WD was disabled in Virtual Machine, the web browser connection from Virtual Machine was in fact disabled by WD in the real system. I checked it by ConfigureDefender logs in Virtual Machine (no blocked event in the log) and in the real system (blocked event in the log).
Simply, my Virtual Machine is configured to use the Internet connection of the real system (default settings in Virtual Box ---> Connected to: NAT). So, I have to test it in the real system, or change the settings of VM.
I use a bridged network connection.
 

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
So, here is the test in the real machine (Windows 10 Pro ver 1903).
  1. Use Defender Control to disable WD - Defender Control changes color to red and shows that WD is disabled. Two WD services disabled (WdNisSvc and WinDefend).
  2. Open smartscreentest2.net in the web browser (not blocked by WD Network Protection).
  3. Restart Windows - WD icon not visible on System Tray.
  4. Open smartscreentest2.net in the web browser (blocked by WD Network Protection).
  5. Run Defender Control - it shows that WD is enabled (????). I looked at Windows services and previously disabled WD services are running now (WdNisSvc and WinDefend).
  6. Run Windows Security Center, it shows Real-time protection disabled (????).
  7. You cannot enable Real-time protection via WSC!!!!:mad: Defender Control tool is not fully compatible with Windows 10 ver. 1903.
So, after using Defender Control your WD is screwed. :notworthy:
Anyway, somehow Network Protection still worked on my system (it should not with disabled WD Real-time protection).

How to restore the functionality of WD? I tried again Defender Control - turned Off and next turned On Windows Defender from it. WD started working again.:giggle:

Edit.
It seems that after several minutes after reboot, Windows Defender is able to enable Real-time protection without using Defender Control. But, WD icon on the System Try is not recovered.
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
@Andy Ful

Are all ASR rules completely available on Windows Home? Have you tested if there are in any difference between Home and Pro?
I tested most of them. They work on Windows Home. There is also no reason for working some of them and not working the rest.
 

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
I disabled Network Protection in CD, rebooted and WdNisSvc still running. Is that switch in CD actually working?
This service works on WD default settings. It is related to Windows Defender Antivirus Network Inspection Service, not to ASR rules or WD Network Protection.
 

Andy Ful

From Hard_Configurator Tools
Thread author
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
So, any ideas what's going on? Flags or extensions interfering. I still get that white smartscreen test page and no Windows notification.
There are some possibilities. One of them is that you use a kind of proxy. So, the web browser does not connect directly with SmartScreen Test, but via proxy server.
I can mimic it by using free proxy website to open SmartScreen Test (not blocked).
 

oldschool

Level 81
Verified
Top Poster
Well-known
Mar 29, 2018
7,043
Please bear in mind that changing DNS takes some time. It is good to run this command from CMD before testing the demo link:
ipconfig /all
to see if DNS has changed. (y)

I lost wifi connection using Adguard. I don't usually fool with these because I lack enough knowledge. Maybe I'd need to change it in the modem, but I bet I'd lose internet completely.
 
  • Like
Reactions: Andy Ful

oldschool

Level 81
Verified
Top Poster
Well-known
Mar 29, 2018
7,043
@Andy Ful I just remembered that when I first tried this test I got the same page except the Bitdefender Trafficlight icon was in the left corner of the tab where tabbed page icons are. I disabled it with the same result, and then I removed BDTL and the tab icon was simply the generic page icon. Very strange.
 
F

ForgottenSeer 72227

@oldschool just want to clarify, have you disabled Network protection, rebooted, then re-enable and rebooted again with the same results? I've had this issue randomly pop up from time to time, but sometimes disabling it, reboot, then re-enable and reboot would fix it for me. Alternatively, maybe try setting all WD's setting back to default, reboot, then re enable all the settings you want, including network protection, reboot and see if that fixes it?
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top