Hard_Configurator - Windows Hardening Configurator

[Gandalf_The_Grey]

Trying Hard_Configurator again with a new setup.
Use it like SysHardener to harden Windows.
With WIndows_10_MT_Windows_Security_hardening profile and Validate Admin C.S. off.
Using this profile my HP Office Jet Pro 9015 works without any problems
And would prefer it because it seems that SysHardner has no support and development at this moment.
The support and dedication of @Andy Ful is above anything seen before
Beta 5.0.0.1 is a bit jumpy on my system and asks me to save my configuration every time I open the GUI.
So I'm using the stable 5.0.0.0 now.
At the moment I'm seeing 1 warning in the log:

Event Time Record ID Event ID Level Channel Provider Description Opcode Task Keywords Process ID Thread ID Computer User
28-3-2020 10:22:55.106 1564 4 Warning Microsoft-Windows-Security-Mitigations/KernelMode Microsoft-Windows-Security-Mitigations Proces '\Device\HarddiskVolume4\Windows\System32\svchost.exe' (PID 904) is geblokkeerd voor het maken van een onderliggend proces 'C:\WINDOWS\system32\DllHost.exe' met opdrachtregel 'C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}'. 2 0x8000000000000000 904 10676 Nitro NT AUTHORITY\SYSTEM

Do you know what this warning means and how I can solve this?

 

[Andy Ful]

Trying Hard_Configurator again with a new setup.
Use it like SysHardener to harden Windows.
With WIndows_10_MT_Windows_Security_hardening profile and Validate Admin C.S. off.
Using this profile my HP Office Jet Pro 9015 works without any problems

That is OK.

Beta 5.0.0.1 is a bit jumpy on my system and asks me to save my configuration every time I open the GUI.
So iIm using the stable 5.0.0.0 now.

Do you remember the text in the alert from beta 5.0.0.1? I am not sure what was the problem.

At the moment I'm seeing 1 warning in the log:

Do you know what this warning means and how I can solve this?

The warnings with the channel Microsoft-Windows-Security-Mitigations/KernelMode and Event Id 4, are related to Exploit protection "Do not allow child processes" (not H_C related).

Apply mitigations to help prevent attacks through vulnerabilities - Microsoft Defender for Endpoint

Protect devices against exploits with Windows 10 or Windows 11. Windows has advanced exploit protection capabilities, building upon and improving the settings available in Enhanced Mitigation Experience Toolkit (EMET).

docs.microsoft.com

You probably configured Exploit protection mitigations for some applications (maybe Chrome web browser) or this mitigation is predefined (like in the case of Edge Chromium, Outlook etc.).

 

[SeriousHoax]

Do you remember the text in the alert from beta 5.0.0.1? I am not sure what was the problem.

Every time 5.0.0.1 beta is opened whether you change any settings or not it asks to Log off or Refresh explorer when closing.

 

[Gandalf_The_Grey]

Every time 5.0.0.1 beta is opened whether you change any settings or not it asks to Log off or Refresh explorer when closing.

Correct, that's the same issue I had with 5.0.0.1.

 

[Andy Ful]

Every time 5.0.0.1 beta is opened whether you change any settings or not it asks to Log off or Refresh explorer when closing.

Thanks. I will look at this issue.

 

[Gandalf_The_Grey]

That is OK.


Do you remember the text in the alert from beta 5.0.0.1? I am not sure what was the problem.


The warnings with the channel Microsoft-Windows-Security-Mitigations/KernelMode and Event Id 4, are related to Exploit protection "Do not allow child processes" (not H_C related).

Apply mitigations to help prevent attacks through vulnerabilities - Microsoft Defender for Endpoint

Protect devices against exploits with Windows 10 or Windows 11. Windows has advanced exploit protection capabilities, building upon and improving the settings available in Enhanced Mitigation Experience Toolkit (EMET).

docs.microsoft.com

You probably configured Exploit protection mitigations for some applications (maybe Chrome web browser) or this mitigation is predefined (like in the case of Edge Chromium, Outlook etc.).

Thanks @Andy Ful
Like @SeriousHoax said:

Every time 5.0.0.1 beta is opened whether you change any settings or not it asks to Log off or Refresh explorer when closing.

I will look into the exploit protection.
Could be VoodooShield related.
Will look if the error also occurs without VoodooShield.
If not I will report it to @danb

 

[Andy Ful]

@Gandalf_The_Grey,
The GUID from your post ("{3EB3C877-1F16-487C-9050-104DBCD66683}") is related to the WinInetCacheServer. Some people disable Wininet task for privacy reasons, so it can be also related to privacy applications. See for example:

Firefox spawns a DllHost.exe process when downloading ZIP files

I'm running Windows 7 Professional 32-bit. When downloading a ZIP file in Firefox, a DllHost.exe process appears. The command line is this: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F1...

superuser.com

 

[Andy Ful]

Every time 5.0.0.1 beta is opened whether you change any settings or not it asks to Log off or Refresh explorer when closing.

Interesting. I cannot reproduce this issue on my machine. I will test this in my VMs.
Do you use this version now?

 

[SeriousHoax]

Interesting. I cannot reproduce this issue on my machine. I will test this in my VMs.
Do you use this version now?

Yes the beta version. Btw, I installed this over the 5.0 version.

 

[Andy Ful]

Yes the beta version. Btw, I installed this over the 5.0 version.

I tried to reproduce the issue in my VMs, by installing ver. 5.0.0.1 over ver. 5.0.0.0 on Recommended Settings. But, everything works well.
It seems that another security application prevents H_C ver. 5.0.0.1 from making some automatic changes required for the new version.
So, even if you start H_C ver. 5.0.0.1 and close it soon after showing the main window, the alert will be displayed to Log OFF or refresh Explorer. I will try to run update H_C to ver. 5.0.0.1 with installed VoodooShield.
Could you post here the screenshot of the main H_C window on your machine?

 

[Andy Ful]

@SeriousHoax
Are you sure that the issue can be seen with the Recommended Settings? I tried other H_C setting profiles, too. Finally, I could reproduce the issue, but only when using the profile: Windows_10_MT_Windows_Security_hardening. This issue is a simple bug that causes unnecessary alerts.
If your issue is as above, then it is not related to incompatibilities with another security.

 

[SeriousHoax]

@SeriousHoax
Are you sure that the issue can be seen with the Recommended Settings? I tried other H_C setting profiles, too. Finally, I could reproduce the issue, but only when using the profile: Windows_10_MT_Windows_Security_hardening. This issue is a simple bug that causes unnecessary alerts.
If your issue is as above, then it is not related to incompatibilities with another security.

Yes, I'm using this profile Windows_10_MT_Windows_Security_hardening. So the warring only pops up for this profile? 5.0 didn't have this issue.

 

[Lenny_Fox]

@SeriousHoax
Are you sure that the issue can be seen with the Recommended Settings? I tried other H_C setting profiles, too. Finally, I could reproduce the issue, but only when using the profile: Windows_10_MT_Windows_Security_hardening. This issue is a simple bug that causes unnecessary alerts.
If your issue is as above, then it is not related to incompatibilities with another security.

Andy thanks for checking and @SeriousHoax for reporting

Andy, I used this profile as a baseline for my girlfriend's setup (running H_C with Kaspersky Free) . What is different in that setup that it runs into a bug and the other profiles not?

 

[Gandalf_The_Grey]

@Gandalf_The_Grey,
The GUID from your post ("{3EB3C877-1F16-487C-9050-104DBCD66683}") is related to the WinInetCacheServer. Some people disable Wininet task for privacy reasons, so it can be also related to privacy applications. See for example:

Firefox spawns a DllHost.exe process when downloading ZIP files

I'm running Windows 7 Professional 32-bit. When downloading a ZIP file in Firefox, a DllHost.exe process appears. The command line is this: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F1...

superuser.com

Not related to Hard_Configurator, but I think I solved my "WinInetCacheServer" issue.
With your explanation Andy it could only be O&O ShutUp10 or VoodooShield.
Too much protection added by myself in VoodooShield for the new MS Edge.
With VoodooShield at default values, we have a clean log sofar
One of the reasons to love HC, the logs let you see issues you wouldn't have found and solved otherwise.

 

[Andy Ful]

Yes, I'm using this profile Windows_10_MT_Windows_Security_hardening. So the warring only pops up for this profile? 5.0 didn't have this issue.

Andy thanks for checking and @SeriousHoax for reporting

Andy, I used this profile as a baseline for my girlfriend's setup (running H_C with Kaspersky Free) . What is different in that setup that it runs into a bug and the other profiles not?

It is related to the new feature <Update Mode>.
In the profile Windows_10_MT_Windows_Security_hardening, both EXE and MSI files are allowed globally and the <Update Mode> set to ON or MSI would be redundant. So H_C checks it and makes the correction if required. I did not notice, that due to a bug the correction is performed even if it is not required. Of course, the final settings are OK - simply, unnecessary correction produces unnecessary alerts.

 

[Gandalf_The_Grey]

Not related to Hard_Configurator, but I think I solved my "WinInetCacheServer" issue.
With your explanation Andy it could only be O&O ShutUp10 or VoodooShield.
Too much protection added by myself in VoodooShield for the new MS Edge.
With VoodooShield at default values, we have a clean log sofar
One of the reasons to love HC, the logs let you see issues you wouldn't have found and solved otherwise.

Damn, the error is back, investigation continues....
Uninstalled VoodooShield for the moment as part of that investigation.

 

[Gandalf_The_Grey]

Damn, the error is back, investigation continues....
Uninstalled VoodooShield for the moment as part of that investigation.

And I think I found it (again)....
It was CCleaner that I had blocked in Windows firewall.
Reinstalled VoodooShield.

 

[Gandalf_The_Grey]

Okay, it seems that CCleaner was the source of the error:

Event Time Record ID Event ID Level Channel Provider Description Opcode Task Keywords Process ID Thread ID Computer User
28-3-2020 10:22:55.106 1564 4 Warning Microsoft-Windows-Security-Mitigations/KernelMode Microsoft-Windows-Security-Mitigations Proces '\Device\HarddiskVolume4\Windows\System32\svchost.exe' (PID 904) is geblokkeerd voor het maken van een onderliggend proces 'C:\WINDOWS\system32\DllHost.exe' met opdrachtregel 'C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}'. 2 0x8000000000000000 904 10676 Nitro NT AUTHORITY\SYSTEM

Found by the log of Hard_Configurator and the investigation begins from here:

Hard_Configurator - Windows Hardening Configurator

Trying Hard_Configurator again with a new setup. Use it like SysHardener to harden Windows. With WIndows_10_MT_Windows_Security_hardening profile and Validate Admin C.S. off. Using this profile my HP Office Jet Pro 9015 works without any problems (y) And would prefer it because it seems that...

malwaretips.com

Had a hard time letting my old friend CCleaner go
But now it's off my system and replaced by Autoruns and PrivaZer

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.

docs.microsoft.com

Free PC cleaner & Privacy tool

Free PC cleaner & Privacy tool

privazer.com

I will keep checking the logs but hope it stays a clean log.

 

[Andy Ful]

In the new H_C ver. 5.0.1.0, I added additional setting profile named Windows_10_Basic_hardening
It is equal to the Recommended Settings, except that in Recommended Settings the EXE and MSI files are allowed only in user AppData and ProgramData folders. In the Windows_10_Basic_hardening settings, the EXE and MSI files are allowed globally.
I added the profile description:

"Harden Windows 10 while maintaining maximum functionality and compatibility.

Please note: this profile allows the user to install/execute/update applications via EXE and MSI files. The only exceptions are EXE and MSI files executed directly from an archive or email client.
The scripts, shortcuts and other files with unsafe extensions are blocked by default in UserSpace.
The "Run By SmartScreen" entry in the Explorer context menu can be used to check the standalone application installers by SmartScreen Application Reputation service.

It is recommended to use this profile with ConfigureDefender HIGH Protection Level (if WD is the main antivirus) and "Recommended H_C" firewall outbound block rules (see <FirewallHardening> option). The profile can be used also with another antivirus with strong proactive detection."

 

[oldschool]

You have a lot of layers which makes for more debugging work.

And now @Andy Ful has made a new profile for you!