Hard_Configurator - Windows Hardening Configurator

[Kantry123]

What concrete protection you have applied?

defender High
SRP applied with Default Deny (Recommended restrictions)
Restrictions (Recommended ones)

Will this be suffice or should add any other 3rd party application too ?

 

[Andy Ful]

defender High
SRP applied with Default Deny (Recommended restrictions)
Restrictions (Recommended ones)

Will this be suffice or should add any other 3rd party application too ?

So you are using Windows Defender + H_C (recommended settings + ConfigureDefender high settings)? I assume that your system is Windows 10. Did you upgrade to ver. 1709 or higher?
What do you mean by "only allowing the proceses that are trusted and verified"?

 

[Kantry123]

So you are using Windows Defender + H_C (recommended settings + ConfigureDefender high settings)? I assume that your system is Windows 10. Did you upgrade to ver. 1709 or higher?

mine is at 1809 i had to roll back from 1903 as its way too buggy.

 

[Andy Ful]

mine is at 1809 i had to roll back from 1903 as its way too buggy.
View attachment 212783

Do you use MS Office or Adobe Acrobat Reader?
What do you mean by "only allowing the proceses that are trusted and verified"?
What is your web browser?

...
Does it mean i'm completely safe from viruses that are auto executed like Ransomware etc ?
and yeah i mean the viruses from Flash Drives from one PC to Another?

There is no such protection. But, if you do not intentionally bypass SmartScreen alerts or turn off default-deny protection, then the chances of infecting the system are similar to winning the National Lottery.
I assume that you have also hardened your browser by using AppContainer + some security flags + good antiphishing & Ads filtering.

 

[Kantry123]

Do you use MS Office or Adobe Acrobat Reader?
What do you mean by "only allowing the proceses that are trusted and verified"?
What is your web browser?

yes i use Ms office 365
I've adobe acrobat Dc pro
chrome and Firefox are my browsers.
Only Allowing UAC only if the process is digitally signed Except H_C

yes the disadvantage i feel is every-time I've to switch off default deny to Install anew program.

regards

There is no such protection. But, if you do not intentionally bypass SmartScreen alerts or turn off default-deny protection, then the chances of infecting the system are similar to winning the National Lottery.
I assume that you have also hardened your browser by using AppContainer + some security flags + good antiphishing & Ads filtering.

app container i don't know what it is but i'm using Adguard desktop version and lastpass for password magmt.

thats it

 

[Andy Ful]

...
yes the disadvantage i feel is every-time I've to switch off default deny to Install anew program.
..

In fact, you do not have to do it. In most cases, you can use "Run As SmartScreen" from the Explorer context menu to install applications without turning off default-deny.

 

[Kantry123]

In fact, you do not have to do it. In most cases, you can use "Run As SmartScreen" from the Explorer context menu to install applications without turning off default-deny.

I just ran it with Run as smartscreen but I get this popup even though the file is digitally signed.
same is with UNSIGNED APPLICATION too..

this popup is for Signed application ESET Online scanner.

Am i doing something wrong ?

 

[Andy Ful]

app container i don't know what it is ...
thats it

It is time to learn about it and about security flags in Chrome or use Edge.
Search MT, there are many posts about this topic.

 

[oldschool]

Listen @Kantry123 Skywalker and learn from the master! :notworthy: He is very wise!

Edit: But you must also apply yourself and learn. Access the wisdom that resides in this effort.

 

[Andy Ful]

I just ran it with Run as smartscreen but I get this popup even though the file is digitally signed.
same is with UNSIGNED APPLICATION too..

View attachment 212784

this popup is for Signed application ESET Online scanner.

Am i doing something wrong ?

I do not think that you have used "Run As SmartScreen" or it is blocked by another security application. Could you please, send the screenshot of the main Hard_Configurator window here?
Did you read the H_C FAQ, especially the below section (read about the order of pressing the buttons):

How to restore Recommended settings.

1. Press <Recommended SRP> left panel button,
2. Press <Recommended Restrictions> right panel button,
3. Press <APPLY CHANGES> button.

Restoring the Recommended settings preserves the user's whitelisted entries and blocked file extensions.

PLEASE NOTE: If SRP is deactivated, then order of the pressed buttons is important! Pressing the buttons in another order (for example 2,1,3) will prevent installation of new applications. This kind of a locked setup is much more restricted as compared to Recommended settings.

Hard_Configurator

...
Edit: But you must also apply yourself and learn. Access the wisdom that resides in this effort.

 

[Kantry123]

I do not think that you have used "Run As SmartScreen" or it is blocked by another security application. Could you please, send the screenshot of the main Hard_Configurator window here?
Did you read the H_C FAQ, especially the below section (read about the order of pressing the buttons):

How to restore Recommended settings.

1. Press <Recommended SRP> left panel button,
2. Press <Recommended Restrictions> right panel button,
3. Press <APPLY CHANGES> button.

Restoring the Recommended settings preserves the user's whitelisted entries and blocked file extensions.

PLEASE NOTE: If SRP is deactivated, then order of the pressed buttons is important! Pressing the buttons in another order (for example 2,1,3) will prevent installation of new applications. This kind of a locked setup is much more restricted as compared to Recommended settings.

Hard_Configurator

 

[Andy Ful]

View attachment 212785View attachment 212785

The settings are correct. Did you try to right-click on the esetonlinescanner executable and choose "Run As SmartScreen" option from Explorer context menu?

 

[Kantry123]

The settings are correct. Did you try to right-click on the esetonlinescanner executable and choose "Run As SmartScreen" option from Explorer context menu?

Order of pressing the buttons fixed it.
i thought the order does not matter.
Thanks and now Run as smartscreen works..!!

Thanks a ton

 

[Andy Ful]

Order of pressing the buttons fixed it.
i thought the order does not matter.
Thanks and now Run as smartscreen works..!!

Thanks a ton

Thanks, for testing. Be safe.

 

[shmu26]

It is time to learn about it and about security flags in Chrome

Which flags do you consider important for Chrome on Windows 10?

 

[oldschool]

Which flags do you consider important for Chrome on Windows 10?

Search MT, there are many posts about this topic.

Check this thread: Discuss - List of Interesting Experimental Flags for Google Chrome

 

[shmu26]

Check this thread: Discuss - List of Interesting Experimental Flags for Google Chrome

Yup, I have been following that thread, more or less, and I am interested to hear Andy's perspective on it.

 

[Andy Ful]

Yup, I have been following that thread, more or less, and I am interested to hear Andy's perspective on it.

I do not have a clear personal opinion about Chrome security flags, except the flags related to AppContainer. I often use Edge, and now I test Chromium Edge Dev with the below enabled/disabled security flags:
Anonymize local IPs exposed by WebRTC, Extension Content Verification, Block scripts loaded via document.write, Enable AppContainer Lockdown, TLS 1.3 downgrade hardening, Mark non-secure origins as non-secure, Enable GPU AppContainer Lockdown, PDF Isolation, Block unsafe downloads over insecure connections, Enable IE Integration (set to Disabled), Service Worker Push Messaging (set to Disabled).

 

[Special]

Since my post the other day had to get approved by a moderator, it got lost in the activity a page or two back, so I'm going to repost what I asked earlier.

Is there a portable version of this? If not, will there ever be one? I love the fact that ConfigureDefender is just a no hassle, tweak then done, very clean and light.

Thanks.

 

[oldschool]

@Special - This is Hard_Configurator thread. Do you mean ConfigureDefender or H_C? CD is portable. H_C is not.