Hard_Configurator - Windows Hardening Configurator

[Andy Ful]

@Andy Ful
Can I still use this tool on windows 10 pro version?or it doesn't work on pro?

I use it on Windows 10 Pro without issues. But, one should not activate Software Restriction Policies using gpedit.msc or secpol.msc. The policies configured by Group Policy Editor are refreshed periodically and can overwrite Hard_Configuration settings in the Registry. This is true for any shared policy of Hard_Configurator and Group Policy Editor.

 

[Sunshine-boy]

I changed some setting in grp policy via tips I found on google but didn't touch software restriction policy.
That group policy changes will go if I install your tool??

 

[Andy Ful]

I changed some setting in grp policy via tips I found on google but didn't touch software restriction policy.
That group policy changes will go if I install your tool??

Simply install Hard_Configurator and activate the options from the right panel. The next day look which of them has been changed.

 

[Andy Ful]

I changed some setting in grp policy via tips I found on google but didn't touch software restriction policy.
That group policy changes will go if I install your tool??

Also, the default Windows policy setting is shown in Hard_Configurator as 'OFF'. So, after the first Hard_Configurator run, the shared policies changed by Group Editor to non default, will be shown in Hard_Configurator as 'ON' or '?'.

Edit
Added '?' in the last sentence.

 

[Sunshine-boy]

Thnx for the tips.

 

[AlanOstaszewski]

"Program nie jest dla mnie, tylko dla użytkowników." - @Andy Ful
The program is not for me. It is only for users.

More Windows Defender tweaks will came to the next update! I can't wait for this!

 

[Av Gurus]

@Andy Ful
If I run this program and only apply Validate Signatures reg tweak and add some portable apps in whitelist will it work?
(is this a solution for question from other theme, you know what I mean)

 

[Andy Ful]

...
More Windows Defender tweaks will came to the next update! I can't wait for this!

This is a good proposition from @askalan, to add the option for activating Defender's highest detection level (extended cloud check).

 

[Andy Ful]

@Andy Ful
If I run this program and only apply Validate Signatures reg tweak and add some portable apps in whitelist will it work?
(is this a solution for question from other theme, you know what I mean)

There is no problem to run Hard_Configurator. You have to temporarily turn OFF Validate Signatures, as with your portable applications. The same is true when installing new programs, because of Run As SmartScreen executable which forces SmartScreen check. When Validate Signatures is turned ON, then 'Run As SmartScreen' option is not available.

Edit.
For the daily work (no configuration changes, no installing new programs), Hard_Configurator settings coexist peacefully with Validate Signatures. This is possible because no Hard_Configurator executable is required to maintain the settings, they are saved in the Registry.

 

[Andy Ful]

One thing should be remembered. The Validate Signatures UAC setting, can be bypassed via any UAC bypass, so it is much stronger on SUA, as compared to Administrator Account. The strongest setup is Disable Elevation on SUA. In this case, all admin work + installing new programs have to be done on Administrator Account.

Edit.
In the Validate Signatures setting only signed and validated programs can elevate on all type of accounts, but can be baypassed on Admin Account. The Disable Elevation on SUA setting applies only to SUA (has no impact to Admin Account).

 

[Andy Ful]

"Program nie jest dla mnie, tylko dla użytkowników." - @Andy Ful
The program is not for me. It is only for users.

More Windows Defender tweaks will came to the next update! I can't wait for this!

I have bad news about Defender tweaks. I planned to add the Defender CloudBlockLevel option, which makes use of more aggressive scanning in the cloud. But it seems, that this option will be redesigned and unavailable for home users in Fall Creators Update.
Policy CSP - Defender
Also, Defender EnableControlledFolderAccess option (anti-ransomware), will be probably unavailable for home users.
Policy CSP - Defender
The good news is that the AllowIntrusionPreventionSystem will be introduced as default for home users (related to Exploit Guard) , like other older options (Script Scanning, Behavior Monitoring).
So, there won't be any changes, in the next Hard_Configurator version, related to Defender tweaks.

 

[AlanOstaszewski]

So, there won't be any changes, in the next Hard_Configurator version, related to Defender tweaks.

That isn't your problem... That is the problem of Microsoft.

 

[Av Gurus]

But PRO version have it

 

[Andy Ful]

But PRO version have it

Yes. It can be configured through GPO, easily.

 

[Av Gurus]

Maybe you can add this options with label "Only for Pro version" on next Hard_Configurator

 

[Andy Ful]

For now, Hard_Configurator is directed to Windows Home users, who cannot configure Windows hardening settings via GPO. All Hard_Configurator settings can be set on Windows Home, only via the reg tweaks. Messing with the Registry is inconvenient and dangerous for most home users, so I created Hard_Configurator. But, I will keep your suggestion in mind.

 

[Sunshine-boy]

Malicious CHM Files Being Used to Install Brazilian Banking Trojans
Can Hard_Configurator handle this?

 

[Andy Ful]

Malicious CHM Files Being Used to Install Brazilian Banking Trojans
Can Hard_Configurator handle this?

Yes. If you will try to open any CHM file in the User Space it will be blocked in recommended settings (<Recommended SRP> + <Recommended Restrictions>).

 

[Sunshine-boy]

Good to see this tool can block almost everything hahah FFFFTTWW hacker:notworthy:

 

[Tiny]

Also, Defender EnableControlledFolderAccess option (anti-ransomware), will be probably unavailable for home users.

Glad to see that they did include it.