Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 953367" data-attributes="member: 82776">This weekend I replaced the desktop of an aunt from Windows7 to Windows10. Because NVT SysHardener is not maintained I decided to use Hard_Configurator to replace SysHardener with following settings:Default allow SRP with some hardening:- blocking scripts sponsors- protecting Windows folders- documents Anti-Exploit (VBA)- protect mail clients- harden SMB- elevate only signed programs- disable Windows Script- block powershell scriptsAdditional manual hardeningFurthermore I disabled command and scripts with registry editor. I also disable mshta.exe by enabling all possible Exploit Protections in MD app&amp; browser control plus I enable code integrity guard for Explorer and Edge. In the Firewall rules I enable blocking all sponsors except explorer.exe (I thought that Explorer needs outbound connection for smart screen?). I also set Configure_Defender on Max.Question to [USER=32260]@Andy Ful[/USER]Would you please make disabling commands and scripts an extra option in the MORE ... (right column hardening of H_C). By hiding this in&nbsp; the MORE hardening options, you could set it default to enabled. I know disabling command should only be done on a Vanilla Windows10 install (no need for third party to enable stuff through commands). I have disabled cmd.exe since Microsoft replaced it as default command shell (<a href="https://support.microsoft.com/en-us/windows/powershell-is-replacing-command-prompt-fdb690cf-876c-d866-2124-21b6fb29a45f" target="_blank">link</a>).P.S.I always install a cheap digital license Office Home&amp;Student version. MD with&nbsp; the ASR rules enabled by ConfigureDefender is in my opinion the best anti-virus for use with M$Office.</blockquote>

[QUOTE="Lenny_Fox, post: 953367, member: 82776"] This weekend I replaced the desktop of an aunt from Windows7 to Windows10. Because NVT SysHardener is not maintained I decided to use Hard_Configurator to replace SysHardener with following settings: [B]Default allow SRP with some hardening:[/B] - blocking scripts sponsors - protecting Windows folders - documents Anti-Exploit (VBA) - protect mail clients - harden SMB - elevate only signed programs - disable Windows Script - block powershell scripts [B]Additional manual hardening[/B] Furthermore I disabled command and scripts with registry editor. I also disable mshta.exe by enabling all possible Exploit Protections in MD app& browser control plus I enable code integrity guard for Explorer and Edge. In the Firewall rules I enable blocking all sponsors except explorer.exe (I thought that Explorer needs outbound connection for smart screen?). I also set Configure_Defender on Max. [B]Question to [USER=32260]@Andy Ful[/USER][/B] Would you please make disabling commands and scripts an extra option in the MORE ... (right column hardening of H_C). By hiding this in the MORE hardening options, you could set it default to enabled. I know disabling command should only be done on a Vanilla Windows10 install (no need for third party to enable stuff through commands). I have disabled cmd.exe since Microsoft replaced it as default command shell ([URL='https://support.microsoft.com/en-us/windows/powershell-is-replacing-command-prompt-fdb690cf-876c-d866-2124-21b6fb29a45f']link[/URL]). P.S. I always install a cheap digital license Office Home&Student version. MD with the ASR rules enabled by ConfigureDefender is in my opinion the best anti-virus for use with M$Office. [/QUOTE]

Verification