Hard_Configurator - Windows Hardening Configurator

[wat0114]

When using SAC, one must fully rely on Microsoft. So, there is much to do for making SAC usable.

This limitation of SAC makes it a dealbreaker from my pov.

 

[ForgottenSeer 95367]

This limitation of SAC makes it a dealbreaker from my pov.

SAC is still in the alpha\early beta stage. So it's too early to judge it, but I wouldn't bet 1 euro that Microsoft will make SAC a well-polished product. Just look at MDAC; Microsoft started on it, but then further development came to a crawl. The only real options in the same class of default deny are SMB and enterprise third party security software.

 

[wat0114]

So it's too early to judge it, but I wouldn't bet 1 euro that Microsoft will make SAC a well-polished product.

Unfortunately I think you are right, so I will not be "downgrading" to 22H2. Why can't MS get SAC, which currently seems to be a half-baked joke, to work properly yet? It's like their development team is made up people with stunted attention spans who can't concentrate on anything for more than a few minutes at a time, and are unable to see anything through to to its completion. To me it's inexcusable. I remember clearly years ago Applocker working exactly as intended out of the box when Windows 7 Ultimate was released. And of course before that the same with SRP. Applocker still remains my favourite Windows built-in security feature. Too bad now it's only available to enterprises, Server and the Education version of Windows.

EDIT

Btw, my rant is fueled not just by this SAC stupidity, but also by other bizarre decisions MS has made over the years with Windows versions since 7, such as deprecating the ability to display messages and send emails using Task Scheduler, making Applocker unavailable to individuals, and even the bizarre removal of seconds on their task bar clock.

 

[ForgottenSeer 95367]

It's like their development team is made up people with stunted attention spans who can't concentrate on anything for more than a few minutes at a time, and are unable to see anything through to to its completion.

Everyone thinks Microsoft's development teams operate in a proficient and military manner. Nothing could be further from the truth. For one, Microsoft has employee turnover that impacts their projects. Then there are competing priorities within the company itself and a lack of long-term commitment to sub-projects.

I don't know why everybody is treating 22H2 as a stable, general release. It's not. It is a preview build. And it is full of problems. So part of the problem are users thinking it is a stable release.

 

[Andy Ful]

Guys, it would be better to continue the discussion about the pros and cons of SAC in another thread, like:

New Update - Smart App Control - Windows 11 22H2 feature promises significant protection from malware

I am curious how it will work in practice.:) https://www.windowslatest.com/2022/03/05/windows-11-22h2-feature-promises-significant-protection-from-malware/amp/ It will probably use Microsoft ISG, so many false positives are expected. Anyway, it can be some solutions for children and happy...

malwaretips.com

There are several interesting aspects related to SAC and most of them are not related to H_C.

 

[ErzCrz]

@Andy Ful Out of curiosity, this blocking of brute force attacks aready covered with H_C Recommended settings?
All Windows Versions Can Now Block Admin Brute Force Attacks

 

[Andy Ful]

@Andy Ful Out of curiosity, this blocking of brute force attacks aready covered with H_C Recommended settings?
All Windows Versions Can Now Block Admin Brute Force Attacks

No. This is a new Windows policy. It is possible that I will add it to SWH and H_C. It is not necessary at home, because brute force attacks can hardly happen with current H_C settings. Anyway, such attacks can sometimes happen when the computer is used for hybrid work.

 

[ErzCrz]

No. This is a new Windows policy. It is possible that I will add it to SWH and H_C. It is not necessary at home, because brute force attacks can hardly happen with current H_C settings. Anyway, such attacks can sometimes happen when the computer is used for hybrid work.

Thanks for the info!

 

[learningexp]

Applying the recommended settings in HC, ConfDefender and FwHardening results in being unable to install any extension from the edge store (An error has occurred Download interrupted).
Is this related? How should I allow installing extensions?
Thank you!

LE: issues with microsoft servers. Just tried it now and it works. Sorry.

 

[mkoundo]

You can also check in Tools > Blocked Events/Security Logs to see what has been blocked

 

[Andrezj]

what registry key enables contrained language mode?

 

[Andy Ful]

what registry key enables contrained language mode?

This is an internal feature of SRP, related to Default Security Level (Disallowed or BasicUser).

 

[piquiteco]

@Andy Ful I have an old PC that has Win 8.1 installed. Does Hard Configurator work on that version of windows? or is it only on windows 10 and 11? Thanks!

 

[Andrezj]

This is an internal feature of SRP, related to Default Security Level (Disallowed or BasicUser).

on windows 11 pro 22h2 i tested H_C:
install H_C
install SRP
enable default security level = disallow

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\CodeIdentifiers\DefaultLevel = 0

constrained language mode is not enabled in standard user powershell console nor when install H_C with -p switch

[system.console]::WriteLine("Test") is not blocked in standard or admin console; powershell running in full language mode
import-module -name az.account is not blocked in standard or admin console; powershell running in full language mode

 

[oldschool]

@Andy Ful I have an old PC that has Win 8.1 installed. Does Hard Configurator work on that version of windows? or is it only on windows 10 and 11? Thanks!

Yes. IIRC it has a W8 and other profiles, but I haven't used it in quite some time.

 

[Andy Ful]

@Andy Ful I have an old PC that has Win 8.1 installed. Does Hard Configurator work on that version of windows? or is it only on windows 10 and 11? Thanks!

It works for Windows Vista up to Windows 10. On Windows 11, it works only when upgraded from Windows 10.

 

[Andy Ful]

on windows 11 pro 22h2 i tested H_C:

The (classic) SRP often does not work on Windows 11 22H2.
https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/post-574990

On Windows Pro, one can use AppLocker (via GPO).

On Windows Home/Pro, one can also use HomeApplocker (currently only script version via MDM WMI Bridge):
https://malwaretips.com/threads/applocker-on-windows-home.118614/post-1011236

 

[Andrezj]

SRP does not work on Windows 11 22H2.

Hard_Configurator - Windows Hardening Configurator

Post updated in July 2023. WARNING! The fake domain hard-configurator.com is currently (May 2023) used by some malicious actors. Please do not use it. Someone tries to fool people who want to get information about Hard_Configurator. Support for Windows 11 22H2 was added in the new version...

malwaretips.com

upgraded system windows 10 to 11
not clean install 11 22h2
srp works fine; constrained language mode does not get set

 

[Andy Ful]

upgraded system windows 10 to 11
not clean install 11 22h2
srp works fine; constrained language mode does not get set

Interesting - if SRP works fine then Constrained Language Mode (CLM) should work too. I cannot say for sure, but there can be some incompatibility with other security layers. After your post, I tested SRP + CLM on Windows Home 21H2 (works well) and on Windows Pro 22H2 (did not work). But, in the second case, the issue was related to my tests with HomeApplocker.
It is interesting that removing HomeApplocker policies did not work. The SRP functionality has been restored after removing two folders:
c:\Windows\System32\AppLocker\MDM
c:\Windows\SysWOW64\AppLocker\MDM

 

[Andrezj]

Interesting - if SRP works fine then Constrained Language Mode (CLM) should work too. I cannot say for sure, but there can be some incompatibility with other security layers. After your post, I tested SRP + CLM on Windows Home 21H2 (works well) and on Windows Pro 22H2 (did not work). But, in the second case, the issue was related to my tests with HomeApplocker.
It is interesting that removing HomeApplocker policies did not work. The SRP functionality has been restored after removing two folders:
c:\Windows\System32\AppLocker\MDM
c:\Windows\SysWOW64\AppLocker\MDM

it is strange behavior
one upgraded system 11 22h2 CLM does not work
another upgraded 11 22h2 system CLM does work; dot-net of some scripts is blocked by CLM