Hard_Configurator - Windows Hardening Configurator

Sorry for the offtopic but I have one last question that keeps me awake at night. :) I'm thinking that maybe by mistake he left it out.

oldschool said:
I use Defender with maximum settings and firewall hardening rules and nothing else. No SWH or H_C here.
Click to expand...

Just CD MAX+FirewallHardening with LOLBins and no Run By SmartScreen?
 
If I understand correctly, Sponsors=LOLBins?

I'm thinking of @oldschool configuration.If Sponsors=LOLBins, FirewallHardening ADD LOLBins can be obtained in this way too?

1. Press <Load Profile> and choose All_OFF.hdc
2. Press <(Re)Install SRP>
3. Press <Block Sponsors> <Select All>
4. Apply changes.

There are 178 in total.

Is one better than the other? It is better to block LOLBins from FirewallHardening or Sponsors this way. LOLBins contain the same number?
 
  • Like
Reactions: simmerskool and Andy Ful
Do the lists have similar content the only difference is how they prevent an attack?

I really wanted to ask you, in your setup do you also run Run By SmartScreen?
 
  • Like
Reactions: simmerskool
skiper said:
Is one better than the other? It is better to block LOLBins from FirewallHardening or Sponsors this way. LOLBins contain the same number?
Click to expand...

Blocking all LOLBins via <Block Sponsors> can be kinda risky for most users. I do not recommend it, as a set-and-forget setup.
I block all LOLBins on one of my wife's computers, but she uses it only for web browsing, watching films, and listening to music.
Blocking outbound connections via FirewallHardening is much less invasive.
 
  • +Reputation
  • Like
  • Thanks
Reactions: vtqhtr413, simmerskool, wat0114 and 2 others
Well the idea wasn't to be paranoid about blocking everything. :)
I was thinking of something else.

I saw that the Enhanced profiles add 22 Sponsors. But with LOLBins added, do the 22 Sponsors make sense? Or a profile without Enhanced and just with LOLBins? I was thinking maybe they overlap...

I also have a question, does the Recommended Settings of this Default-Deny setup work "like a wall"? If you watch what the SmartScreen warns and don't use the Default Deny Switch to turn it off, you can get infected ? The only weakness may be the SmartScreen if it is tricked?

I mean for example without using Install By SmartScreen, if I have a folder full of all sorts of "viruses" and I pick them up one by one, can anything get past the Default-Deny setup? Are they blocked with the message "This app has been blocked by your system administator"?

Because I'm not good at it and in my head it looks that way. Click click click click and nothing happens :)
 
skiper said:
also have a question, does the Recommended Settings of this Default-Deny setup work "like a wall"? If you watch what the SmartScreen warns and don't use the Default Deny Switch to turn it off, you can get infected ?
Click to expand...
Why don't you start a PC configuration thread and you can get feedback there? As to your question, the recommended settings are plenty secure, but don't go downloading malware files.
 
  • Like
  • +Reputation
Reactions: vtqhtr413, simmerskool, Andy Ful and 3 others
I just went back to H_C from WHHL on Windows 11 21H2 Pro, recently imaged btw, because I like the extra configurability of H_C. I have "High" setting for CF, Disallowed/Skip DLL's for SRP, and Block Sponsors-> Enhanced but not Script interpretors (16 checked) enabled. I might start adding more Sponsors to block, as my Windows needs are simple browsing, some Office like Excel and Word, and a little email. That's about it. Logs can be checked if something doesn't work as expected, so modifications to the Sponsors list can be made if it caused the breakage, and of course SRP and CF rules can be modified as well.

@skiper

you could easily start with Recommended settings as oldschool suggests, then if you like, add additional protections in a piecemeal fashion if you want to enhance security, even if it's not needed.
 
  • Like
  • Thanks
Reactions: SirJon, oldschool, Andy Ful and 1 other person
skiper said:
I mean for example without using Install By SmartScreen, if I have a folder full of all sorts of "viruses" and I pick them up one by one, can anything get past the Default-Deny setup? Are they blocked with the message "This app has been blocked by your system administator"?
Click to expand...

Almost all will be blocked, except files that cannot be blocked (like documents, media files, etc.). The unblocked files will be opened by legal applications, but some of those files can be exploits. If you use MS Office and Adobe Reader, then almost all exploits can be prevented by Defender with ConfigureDefender High, Interactive, or Max settings.

When you use other applications for opening documents, you should restrict them (especially macros and scripts). If not then you can block some popular LOLBins + CMD and PowerShell console.

It is still possible, but very improbable that something else can hurt your system.
Even if you lock completely your system with all known security applications, there will be always some (minimal) probability of infection.
 
  • Like
  • +Reputation
Reactions: vtqhtr413 and skiper
There can be probably some difference in the computer security when getting out of bed on the right side.
It is good to realize that adding more and more security makes a similar difference.:)(y)
 
  • Like
Reactions: vtqhtr413 and skiper
Is it possible to block powershell scripts by SRP and not globally by Reg Tweak.
Or scripts are capable to easily bypassing SRP?
 
Azazel said:
Is it possible to block powershell scripts by SRP and not globally by Reg Tweak.
Or scripts are capable to easily bypassing SRP?
Click to expand...

Yes, they can be restricted only by SRP (without blocking all scripts). SRP in H_C restricts PowerShell scripts and PowerShell CmdLines by applying ConstrainedLanguage Mode.
 
  • Like
  • +Reputation
Reactions: vtqhtr413, simmerskool and oldschool
hello !

I really like this free tool. All the work done by the developer... thank you for this software.

I understand that settings make Windows difficult to access, but with whitelisting, I find it fine.

how to set Hard_Configurator to make Windows secure and not unusable or difficult to use?
What to check?

Hard_Configurator(x64)_mZxZKVzrbM.png
Hard_Configurator(x64)_uRCZhuhzv7.png
explorer_kkOLsVh7on.png


it is OK like this ?
 
Last edited:
  • Like
Reactions: kylprq and Andy Ful
sypqys said:
hello !

I really like this free tool. All the work done by the developer... thank you for this software.

I understand that settings make Windows difficult to access, but with whitelisting, I find it fine.

how to set Hard_Configurator to make Windows secure and not unusable or difficult to use?
What to check?

View attachment 282410View attachment 282411View attachment 282412

it is OK like this ?
Click to expand...

It would be better to set < Block Remote Access> = ON and use FirewallHardening to restrict outbound connections of popular LOLBins (H_C Recommended).
You can also set <Forced SmartScreen> = "Standard User" and use "Run By SmartScreen" from the Explorer context menu as an on-demand file reputation scanner.
In such settings, the EXE and MSI files are protected mostly by AV (not blocked by H_C).
 
  • Like
  • +Reputation
Reactions: vtqhtr413, simmerskool and dronefox1166

You may also like...