Hard_Configurator - Windows Hardening Configurator

Hard_Configurator Tools
4,521 Replies 1,188,093 Views
Outpost said:
@Andy Ful
Your "devotion" to your project is admirable. The level of customer care service is at an excellent level. It's incredible that it's free. I'd be willing to pay for it.
Click to expand...
Thanks. I used many applications for free, so I would like to keep the H_C also free with the help of MT members.:)(y)
 
security123 said:
It would be awesome if the following Windows features can be added to your tool:
Memory integrity (HVCI) - can be configured with registry
Click to expand...
This feature will block many drivers. The user cannot also use virtual machines (VirtualBox, VMware, etc.). It can be easily turn ON from the Windows Security Center (it is part of Core isolation). It requires hardware support.
security123 said:
System Guard Secure Launch - can be configured with registry
Click to expand...
The user cannot also use virtual machines. It can be easily turn ON from the Windows Security Center (it is part of Core isolation). It requires hardware support. There were serious issues reported.
security123 said:
enable sandboxing for Windows Defender Antivirus
Click to expand...
It is not finished. Why doesn't Microsoft turned it ON by default? It is so important for security.
security123 said:
enforce DEP (Data Execution Prevention) for all processes and not only for system which is default.
Click to expand...
This setting can break many 32-bit applications. For 64-bit applications, DEP is turned ON by default on Windows 10. It can be easily turned ON (for concrete application) from the Windows Security Center (Windows Defender Exploit Protection).

So, I will wait until these features will be more mature or less problematic. (y)
It is probable that some of them will be included in WD Tamper protection, and then I will not include these features in H_C.
 
Last edited:
Last edited:
security123 said:
I wonder if this 1year old "unpredictable and exotic bug" issue is fixed.
Click to expand...
I think so. The problem is that Windows 10 security evolves too quickly. Even without these low-level security features, there are still problems with Windows Updates.
Anyway, all Core Isolation features are important in enterprises. For example, System Guard Secure Launch is directed to protect the system against abused firmware drivers, because they are not protected by standard security solutions.
 
security123 said:
@Andy Ful did you plan to disable the Windows internal EFS feature do to the new ransomware?
...
Click to expand...
I do not know. If this feature is not required then it should be disabled.
But, this feature does not work on Windows Home (EFS service is disabled by default) and most AVs including WD will detect this method very soon. It will not be especially popular in widespread attacks. Furthermore, the H_C Recommended Settings already prevents ransomware delivery or execution.
This service can be used by some applications that encrypt files/folders so I am not sure if it would be safe to disable it.
 
Andy Ful said:
It would be fine if the website could work on mobile devices too, but it is probably not a big issue because H_C does not support mobile devices. That is why no one reported such a problem until now. :)
Click to expand...
Btw, I have 3rd party scripts disabled and when I load the site it doesn't show anything for about 10 seconds everytime I load the page but if I enable the script it loads instantly. Is this what google shamelessly does to amp sites when the script is disabled? I may have read somewhere a year ago about this 10 seconds delay. I can understand images not loading since the script is blocked but the 10 seconds delay is bad.
 
SeriousHoax said:
Btw, I have 3rd party scripts disabled and when I load the site it doesn't show anything for about 10 seconds everytime I load the page but if I enable the script it loads instantly. Is this what google shamelessly does to amp sites when the script is disabled? I may have read somewhere a year ago about this 10 seconds delay. I can understand images not loading since the script is blocked but the 10 seconds delay is bad.
Click to expand...
The browser probably does not recognize that the script is blocked and give it some time to load. I think that there is an option somewhere in the browser that allows the website to load without waiting for scripts.
 
Andy Ful said:
The browser probably does not recognize that the script is blocked and give it some time to load.
Click to expand...
Yes you're right. Just now I found another example and it only happens to sites which are dependent on cdn.ampproject.org so based on AMP of google. Some sites gives a warring like this but note on your site.
1.PNG

Anyway, no problem.
 
SeriousHoax said:
Yes you're right. Just now I found another example and it only happens to sites which are dependent on cdn.ampproject.org so based on AMP of google. Some sites gives a warring like this but note on your site.
View attachment 232802
Anyway, no problem.
Click to expand...
I think that @askalan, who is the creator of the H_C website, knows the details of the blocked script.:)(y)
 
Andy Ful said:
H_C in any predefined profile (except All_OFF) blocks shortcuts in UserSpace (also for USB drives), except some whitelisted locations on hard disk like Desktop, Start Menu, etc.
Shortcuts are blocked when SRP is set properly:
  1. <(Re)Install SRP> = Installed
  2. LNK extension is on <Designated File Types>
  3. <Default Security Level> = Disallowed
  4. <Enforcement> = Skip Dlls (also All Files)
  5. <More SRP ...> <Protect Shortcuts> = ON
People who do not like default-deny setup can use the predefined profile: Windows_10_MT_Windows_Security_hardening
which works similarly to SysHardener settings, but additionally block shortcuts, more file extensions, and some dangerous sponsors (mshta.exe, mstsc.exe, wmic.exe).
If the user needs to run unsigned applications with elevation or install/update unsigned applications, then the option <Validate Admin C.S.> must be set to OFF.

You may be sure that shortcuts are blocked by creating a shortcut on USB drive (or anywhere in the UserSpace) and trying to run it.
Click to expand...
This is a little late, but I think I figured out why SRP wasn't working on the wife's laptop. There is a user account on that computer that is a member of Microsoft Family. You already told me that Microsoft Family interferes with SRP.
 
SeriousHoax said:
Yes you're right. Just now I found another example and it only happens to sites which are dependent on cdn.ampproject.org so based on AMP of google. Some sites gives a warring like this but note on your site.
View attachment 232802
Anyway, no problem.
Click to expand...
You can use this extension to bypass AMP sites and open the full site.
chrome.google.com

Chrome Web Store

Add new features to your browser and personalize your browsing experience.
chrome.google.com chrome.google.com
 
shmu26 said:
This is a little late, but I think I figured out why SRP wasn't working on the wife's laptop. There is a user account on that computer that is a member of Microsoft Family. You already told me that Microsoft Family interferes with SRP.
Click to expand...
Yes, and SRP will not work even If you would remove this account. I tried this and the only method is refreshing the Windows.
 
Andy Ful said:
Yes, and SRP will not work even If you would remove this account. I tried this and the only method is refreshing the Windows.
Click to expand...
That's not always necessary. I fixed it one time just by removing the user from Microsoft family.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top