Advanced Plus Security ErzCrz Security Config 2024

[SeriousHoax]

Ah okay. It's Win 11 as it was shipped and SAC disabled. Doesn't really matter since using MD anyway but just something I noticed when I was trying out a couple of different configurations Thanks for the info.

In that comment, I was actually talking about the MsMpEng.exe service that always runs on Windows 11. This MpDefenderCoreService.exe is new, and I don't have it yet. Probably pushed to a few users, mainly those who have enabled early updates like you. Even Microsoft Defender's update channel can be changed to a beta build.

 

[oldschool]

Probably pushed to a few users, mainly those who have enabled early updates like you. Even Microsoft Defender's update channel can be changed to a beta build.

I use beta platform and engine updates.

 

[Andy Ful]

Hi,

Some info about the new services:

New Microsoft Defender Antivirus services on Windows Devices - M365 Admin

Microsoft Defender Antivirus on Windows 10 and Windows 11 will be shipping with two new services: Microsoft Defender Core service. Microsoft Data Loss Prevention Service When this will happen: Preview: Nov ‘23 to Beta channel (Prerelease). Standard: We will begin rolling out mid-January 2024 and...

m365admin.handsontek.net

 

[ForgottenSeer 100397]

It may not always run on systems that were upgraded to 11 from 10 without freshly installing windows. Or if it was disabled using something like Defender Control or other manual method.

A clean installation of Windows 11 with no disabling of Defender using any methods!

 

[oldschool]

Hi,

Some info about the new services:

New Microsoft Defender Antivirus services on Windows Devices - M365 Admin

Microsoft Defender Antivirus on Windows 10 and Windows 11 will be shipping with two new services: Microsoft Defender Core service. Microsoft Data Loss Prevention Service When this will happen: Preview: Nov ‘23 to Beta channel (Prerelease). Standard: We will begin rolling out mid-January 2024 and...

m365admin.handsontek.net

we are shipping the Microsoft Defender Core service which will help with stability and performance of Microsoft Defender Antivirus.

 

[ErzCrz]

Playing around with CF installed as usual. Just running .8012 while I wait for next stable.

My Asus OEM originated MemCompression (system file) tried to connect out ICMPv6 Neighbour Solicitation. There was a old related bug but was fixed in previous versions. Might try out Beta2 and see if it shows up again. It got blocked by default while I looked up the information.

Spoiler: CF MemCompression Alert

 

[ErzCrz]

Did a but more testing CIS/CF Beta. Was wrking quite well but checking logs after full sceen game and firefox running in background, there was a HIPS block of Werfault and checking logs there was a few 1000 application errors. Kind of proves HIPS not ready yet for Win 11 at least with current beta. Haven't had such issue with current stable on my Win 11 machine. I'll just stick with CF with @cruelsister 's setup is the least troublesome route.
Good news on the Beta2 front, the minor program update you get resolves the leftover drivers issue after you uninstall it though the Event Viewer and Startup entries still have to be manually removed.

 

[oldschool]

Please link your current config thread to your account. It's still the 2020 Config.

 

[ErzCrz]

Please link your current config thread to your account. It's still the 2020 Config.

Thanks, I'd forgotten about changing that.

On a different note, my earlier issue might have been Firefox related as it crashed /shrug. Seems changing things too much on this machine makes it unhappy.
Back to MD H_C etc as indicated in this top post and your exploit settings I think.

 

[ErzCrz]

Anti-Exploit settings in line with @oldschool 's config

-------------------------
Complete Exploit Protection settings

System settings:

Control flow guard (CFG) - Use default (On)
Data execution prevention (DEP) - Use default (On)
Force randomization for images (Mandatory ASLR) - On by default
Randomize memory allocations (Bottom-up ASLR) - Use default (On)
High entropy ASLR - Use default (On)
Validate exception chains (SEHOP) - Use default (On)
Validate heap integrity - Use default (On)

Edge:

Block low integrity images - On
Block remote images - On
Validate image dependency integrity - ON
Block untrusted fonts - On
Code integrity guard - On | Also allow images signed by MS Store - Unchecked
Mandatory ASLR (default above) > Do not allow stripped images - Checked
Hardware enforced stack protection - On | Enforce for all modules ... - Checked
Validate handle usage - On
---------------------------------

 

[ErzCrz]

Just updated configuration a little with exploit tweaks. Waiting on CIS/CF further development before testing again.

 

[ErzCrz]

Haven't been able to replicate that issue I had with CIS Beta2. Got a fair bit of time on my hands since i'm off on sick leave re: ErzCrz Status Update 30.11.2023 so time to try out different things. I expect I'll not be instructed not to be back at work until after Chrismas as waiting on a date for a treatment.
Anyway, TMI. Just trying out different things that won't mess up the system. THe Hard_Configurator setup is good though I don't like Microsoft Store updates not updating automatically. The workaround is to turn off the instealler SRP rule but that's a security risk. I'll just thave to check the store manually now and then if going down that route but CF & MD or similar best of both worlds.

 

[ErzCrz]

Given my old Office 2013 ended support back in April I've just been using work system for any document writing/handling but have occasionally ended up using word etc via Edge. Thinking of going more local application now. Office365 is £60.00 for the year and I'm just not sure, that's quite a chunk of change. Might give Libre Office another go.

 

[Gandalf_The_Grey]

Given my old Office 2013 ended support back in April I've just been using work system for any document writing/handling but have occasionally ended up using word etc via Edge. Thinking of going more local application now. Office365 is £60.00 for the year and I'm just not sure, that's quite a chunk of change. Might give Libre Office another go.

You could also try FreeOffice:

FreeOffice: The best free alternative to Microsoft Office

FreeOffice, the best free alternative to Microsoft Office (Word, Excel, PowerPoint) for Windows, Mac and Linux

www.freeoffice.com

Installed that for my father (when he was still alive) and he really liked that.

 

[ErzCrz]

You could also try FreeOffice:

FreeOffice: The best free alternative to Microsoft Office

FreeOffice, the best free alternative to Microsoft Office (Word, Excel, PowerPoint) for Windows, Mac and Linux

www.freeoffice.com

Installed that for my father (when he was still alive) and he really liked that.

Thanks, I'll have a look

 

[ErzCrz]

Just changing things up again some. Back to Comodo Firewall with @cruelsister configuration.
Removed custom exploit rules as having some Edge freezes.
I'm trialling ConfigureDefender - High and WindowsFirewallHardening - Recommended as an additional tweak not noted above but want to ensure no conflicts before confirming the setup. I know neither is necessary so undecided about CD and WFH at the moment.

 

[ErzCrz]

Had some wierd anomolies trying out different configurations yesterday but running old CF Uninstaller and Repairing MD and then doing a CF Fresh install resolved the issue.
Swapped over to Firefox as Primary browser for now.

 

[ForgottenSeer 100397]

There is no instance of MsMpEng running on our Windows 11 systems with Kaspersky. I'll confirm and update here regarding this and the new service.

Today, I checked the system and found that MsMpEng is not running with Kaspersky installed, and the new service is not present. I had performed a clean Win 11 install without disabling Defender manually or with third-party software.

 

[ErzCrz]

Today, I checked the system and found that MsMpEng is not running with Kaspersky installed, and the new service is not present. I had performed a clean Win 11 install without disabling Defender manually or with third-party software.

Hmm, interesting. Will have to check again next time I do a full CIS install. Just running CF and MD at the moment until another beta or eventual stable.

Thanks and Merry Christmas

 

[ErzCrz]

Enjoying Firefox though had a couple of catch up telly playback errors but that may have been ublock rules related. It does use some more resources than Edge though not an issue with my laptop. I did find that Edge's power efficiency particularly good in comparison when i ran a full screen game and had browser windows opened in the background which I know isn't the norm for playing games but Edge used half the resources of Firefox in that instance. Having seen a couple of articles on reducing Edge bloat I am considering making Edge default again but it's apples and oranges I guess it's just a case of using what works best for us.