Hard_Configurator - Windows Hardening Configurator

[Andy Ful]

I have to confess, I even have CFW (with CS settings) running on there - though I have disabled Auto-Containment now while playing with H_C.
Most likely will just keep H_C. Oh, and OSA (some overlap, I know).

The danger is that overlapping configuration is inconvenient. So after some time, the users are irritated with such kind of setup, and they throw out default-deny protection.
With default-deny, is better to keep things as simple as possible and try to accustom to it, first. Even a very simple default-deny is very strong.

 

[bribon77]

On Windows 7, the recommended settings block Windows Script Host and PowerShell. You can use the predefined profile Windows_7_Recommended_Enhanced.hdc . If everything works well then you can add HH.exe and Mshta.exe . In this way you have blocked the most dangerous script interpreters. Keep an eye on blocked items, because some printers and other hardware, can sometimes use interpreters to configure settings.

Sorry for my clumsiness, but I can't find Enhanced.hdc. Where is it?:emoji_innocent:

 

[shmu26]

I have to confess, I even have CFW (with CS settings) running on there - though I have disabled Auto-Containment now while playing with H_C.
Most likely will just keep H_C. Oh, and OSA (some overlap, I know).

Also CFW is extremely light on the system, in my experience. But it does seem to me like you have a lot of overlap there. My "unsolicited advice" would be to run CFW + H_C at "Avast" settings. There is a special template for it. It basically means that .exe and .tmp files are not monitored by H_C, because they are instead monitored by Avast hardened/aggressive, or in your case, by CFW. Andy will please correct me if I am wrong.

 

[Andy Ful]

Sorry for my clumsiness, but I can't find Enhanced.hdc. Where is it?:emoji_innocent:

You have to install the version 4.0.0.0 at least.

 

[Andy Ful]

Also CFW is extremely light on the system, in my experience. But it does seem to me like you have a lot of overlap there. My "unsolicited advice" would be to run CFW + H_C at "Avast" settings. There is a special template for it. It basically means that .exe and .tmp files are not monitored by H_C, because they are instead monitored by Avast hardened/aggressive, or in your case, by CFW. Andy will please correct me if I am wrong.

You are right.

 

[bribon77]

View attachment 207373
View attachment 207374

You have to install the version 4.0.0.0 at least.

Now I found it, Thank you @Andy Ful. I have the latest version of H_C

 

[Windows_Security]

@Andy Ful

Idea for a new product: Edge Configurator : here are Edge Policies mentioned, they also work when adding registry policies through registry: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros)

Here are mine for reference: (export of registry renamed to txt) on my Asus Transformer which I use for travel (hence passwords blocked etc) (Edge_policies.txt).

EDIT: I checked the policies on my Desktop (have a Win10 Pro) and noticed some differences (Edge_GPO.txt).

 

[Andy Ful]

@Andy Ful

Idea for a new product: Edge Configurator : here are Edge Policies mentioned, they also work when adding registry policies through registry: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros)

Here are mine for reference: (export of registry renamed to txt) on my Asus Transformer which I use for travel (hence passwords blocked etc).

I am busy now with Casual User Protection and researching WD Application Control for Windows Home. But I like that idea. If there would be an accepted Edge setting profile, I could add it to H_C.

 

[Windows_Security]

@Andy Ful

There is a secure base line which works for average users, but there would be two optional settings which depend whether user wants a
A) Blank start screen or allowing users to set all startscreen/new tab related functionality through Edge GUI
B) Block passwords or allowing users to set all passwords/forms related functionality through Edge GUI

There are also some additional protections possible through WD exploit protection. That is why I thought you could make it a separate option (like you did with documents anti-exploit).

Send me a PM when you have the time to look at it.

Regards Kees

 

[Andy Ful]

@Andy Ful
...
That is why I thought you could make it a separate option (like you did with documents anti-exploit).
...

Yes, I think that it would be a good idea.

 

[paulderdash]

The danger is that overlapping configuration is inconvenient. So after some time, the users are irritated with such kind of setup, and they throw out default-deny protection.
With default-deny, is better to keep things as simple as possible and try to accustom to it, first. Even a very simple default-deny is very strong.

Thanks, this is pretty much an expendable computer, and just playing at the moment, but yes, will probably just keep H_C, for simplicity.

 

[paulderdash]

Also CFW is extremely light on the system, in my experience. But it does seem to me like you have a lot of overlap there. My "unsolicited advice" would be to run CFW + H_C at "Avast" settings. There is a special template for it. It basically means that .exe and .tmp files are not monitored by H_C, because they are instead monitored by Avast hardened/aggressive, or in your case, by CFW. Andy will please correct me if I am wrong.

You are right.

Thanks guys! Will do, if I keep CFW!

 

[shmu26]

I really like how the "Switch default deny" widget autostarts after reboot, if you switched it off for an install or something. That's just right.

 

[AlanOstaszewski]

It's almost time! The website of Hard_Configurator (hard-configurator.com) will start on 1.2.2019 or 2.2.2019! Final preparations have yet to be made. Be excited!

P.S.: before the start I will publish the latest screenshots, so that you can give one or the other tip!

 

[oldschool]

It's almost time! The website of Hard_Configurator (hard-configurator.com) will start on 1.2.2019 or 2.2.2019! Final preparations have yet to be made. Be excited!

P.S.: before the start I will publish the latest screenshots, so that you can give one or the other tip!

Fantastic news!

 

[Gandalf_The_Grey]

It's almost time! The website of Hard_Configurator (hard-configurator.com) will start on 1.2.2019 or 2.2.2019! Final preparations have yet to be made. Be excited!

P.S.: before the start I will publish the latest screenshots, so that you can give one or the other tip!

Looking forward to it

 

[oldschool]

@askalan - RE: your H_C test today - you may have mentioned previously, are you using straight Recommended SRP settings? Thanks.

 

[Andy Ful]

It's almost time! The website of Hard_Configurator (hard-configurator.com) will start on 1.2.2019 or 2.2.2019! Final preparations have yet to be made. Be excited!

P.S.: before the start I will publish the latest screenshots, so that you can give one or the other tip!

Excellent!

 

[AlanOstaszewski]

@askalan - RE: your H_C test today - you may have mentioned previously, are you using straight Recommended SRP settings? Thanks.

 

[oldschool]

View attachment 207513

I thought so. Thanks!