SECURITY: Complete Gandalf_The_Grey's laptop config for 2020

[Gandalf_The_Grey]

Thinking about Simple Windows Hardening vs Hard_Configurator.
If you use Simple Windows Hardening with ConfigureDefender, FirewallHardening and use Autoruns isn't easier to just use Hard_Configurator with the Windows_10_Basic_Recommended_Settings profile instead?
One tool to install and not having to download and maintain multiple portable programs.
The protection level is the same.
Any pros or cons?
@Andy Ful What do you think?

 

[silversurfer]

Thinking about Simple Windows Hardening vs Hard_Configurator.
If you use Simple Windows Hardening with ConfigureDefender, FirewallHardening and use Autoruns isn't easier to just use Hard_Configurator with the Windows_10_Basic_Recommended_Settings profile instead?
One tool to install and not having to download and maintain multiple portable programs.
The protection level is the same.
Any pros or cons?

Just going to use H_C as you are able to handle tools like that...
I'm personally running WD/MD and using H_C included tools like CD & FH, that's for me easier to control over the main GUI of H_C.

 

[Andy Ful]

@Gandalf_The_Grey

No idea. These configs are the same.
You can use SWH + ConfigureDefender + FirewallHardening via 3 shortcuts on your Desktop (copy these applications first to Windows folder) or use H_C. It will be rather the choice of taste (like which GUI do you like better).

 

[Gandalf_The_Grey]

@Gandalf_The_Grey

No idea. These configs are the same.
You can use SWH + ConfigureDefender + FirewallHardening via 3 shortcuts on your Desktop (copy these applications first to Windows folder) or use H_C. It will be rather the choice of taste (like which GUI do you like better).

After trying both configs I like the one with the standalone tools more.
Just pinned those 3 to the startmenu.
Less exes installed in total and the logging is better / more filtered.
Example: the log of ConfigureDefender contains entries when Microsoft Defender (and the system) starts. Not needed I think.
The logs of the standalone ConfigureDefender doesn't show them.
Both contain some blocks for Controlled Folder Access (needed).

 

[Gandalf_The_Grey]

Experimenting with the for me best and most easy protection for the laptops in my household/family
Tried VoodooShield, but one of the laptops in my household froze completely with it.
Tried Comodo Firewall with CS settings, but it has still a problem with unrecognizing safe Windows files, so needs to be babysitted.
So back to Hard_Configurator where whitelisting is easier than in Simple Windows Hardening because of the apply changes button.
When something is blocked on the laptops of my children it's quite easy to see in the log and if needed whitelist by file.
@Andy Ful Is it correct that there is no apply settings button in Simple Windows Hardening or am I missing something?

 

[oldschool]

Is it correct that there is no apply settings button in Simple Windows Hardening or am I missing something?

It applies basic settings on first run. There are options to restrict Elevation of Unsigned and WSH for more complete protection.

 

[Gandalf_The_Grey]

It applies basic settings on first run. There are options to restrict Elevation of Unsigned and WSH for more complete protection.

That's correct, but what do you do after whitelisting a file? Do you have to log out or reboot?

 

[Andy Ful]

That's correct, but what do you do after whitelisting a file? Do you have to log out or reboot?

Both SWH and H_C ver. 5.1.1.2 apply whitelisted SRP entries on the fly - no need to reboot or Log off. When the reboot is required, then H_C will alert while pressing the <REFRESH> button, SWH alerts about the reboot only when SMB settings are changed.
SWH is much simpler and does not need the <REFRESH> button.

Edit.
If you use this config on the child's computer, then you can set in ConfigureDefender the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" to ON. This should not be a problem, but if something will be blocked by this rule, then please remember to wait about 2 days, or if you are certain that the file is clean set this rule temporarily to Audit and next install/update and finally run the installed/updated application. Do not try to whitelist the blocked file in H_C or exclude it in WD, because this will not work when this ASR rule was triggered.

 

[Gandalf_The_Grey]

@SeriousHoax browser cache problem inspired me to try Kaspersky Security Cloud again
Running great so far, I have slightly more system and browsing speed compared to Windows Defender on high settings.
I hope that Simple Windows Hardening and Documents Anti Exploit from @Andy Ful compensate for the lack of application control in the free version.
This time I also changed form uBlock origin to AdGuard, both are great and maybe I will switch back sometime.
But this time AdGuard's log was more helpful in unbreaking a website my daughter needed for school.
And it is easy to report such breakage and it will be solved in a few days by the AdGuard filter maintainers.

 

[FireHammer]

Hi, Real nice security configuration

 

[SeriousHoax]

slightly more system and browsing speed compared to Windows Defender on high settings.

More browsing speed too? This is surprising Is it about website surfing or internet speed checking website's speed?

 

[Andy Ful]

@SeriousHoax browser cache problem inspired me to try Kaspersky Security Cloud again
Running great so far, I have slightly more system and browsing speed compared to Windows Defender on high settings.
I hope that Simple Windows Hardening and Documents Anti Exploit from @Andy Ful compensate for the lack of application control in the free version.
This time I also changed form uBlock origin to AdGuard, both are great and maybe I will switch back sometime.
But this time AdGuard's log was more helpful in unbreaking a website my daughter needed for school.
And it is easy to report such breakage and it will be solved in a few days by the AdGuard filter maintainers.

Just use standalone RunBySmartscreen to run not-trusted files, especially when extracted from archives or originated from flash drives (USB drives).

 

[Gandalf_The_Grey]

More browsing speed too? This is surprising Is it about website surfing or internet speed checking website's speed?

Surfing is almost the same, in testing I have a slightly lower ping, maybe it's because I want it but browsing feels a bit snappier

 

[Gandalf_The_Grey]

Just use standalone RunBySmartscreen to run not-trusted files, especially when extracted from archives or originated from flash drives (USB drives).

Thanks, and added. Will update my config tomorrow. Now family time...

 

[SeriousHoax]

Surfing is almost the same, in testing I have a slightly lower ping, maybe it's because I want it but browsing feels a bit snappier

Surprising. In my case, I don't notice speed difference if I just casually browse the web but if I go for accurate measurements using a stopwatch () then I can see that with Defender it's slightly faster.

 

[FireHammer]

Inspired by the config of @silversurfer : SECURE: Complete - silversurfer Laptop Security Config 2020
I decided to see what config worked the best on my laptop:
Windows Defender (with ConfigureDefender at High)
Ziggo Safe Online (F-Secure Safe (free from my ISP))
Kaspersky Security Cloud Free
For me, Kaspersky Security Cloud Free is the lightest on my system at the moment while still offering very good protection.
Replaced (maybe temporarily) uBlock Origin with AdGuard for adding Googles Safe Browsing to the mix.

Hi, @Gandalf_The_Grey I also have been offered F-Secure Safe from my ISP-STOFA, but I like Bitdefender more.

 

[Gandalf_The_Grey]

Hi, @Gandalf_The_Grey I also have been offered F-Secure Safe from my ISP-STOFA, but I like Bitdefender more.

My ISP Ziggo offers a rebranded version of F-Secure Safe: Ziggo Safe Online, but I prefer Kaspersky Security Cloud Free (at the moment ).

Added Run By SmartScreen like @Andy Ful suggested.

 

[Gandalf_The_Grey]

Simplified my config based on Windows built-in security.
Just an AV and some Windows hardening should be enough protection.

 

[SeriousHoax]

Are you still using Adguard? I saw a few months old on ongoing issue on their GitHub about few YouTube ads being missed by Adguard. Have you experienced anything like this?

 

[Gandalf_The_Grey]

Are you still using Adguard? I saw a few months old on ongoing issue on their GitHub about few YouTube ads being missed by Adguard. Have you experienced anything like this?

Yep, I'm still using AdGuard. No problems with YouTube ads.
I have added the two filters from Yuki2718: AdGuard Social media Plus and AdGuard Tracking Protection Plus. Maybe those helped?

GitHub - Yuki2718/adblock: Personal filters and rules for AdGuard/uBlock Origin

Personal filters and rules for AdGuard/uBlock Origin - GitHub - Yuki2718/adblock: Personal filters and rules for AdGuard/uBlock Origin

github.com