Advanced Security M4RT1NE2 Security Configuration 2024

[M4RT1NE2]

Wouldn't adding simple windows hardening to my security kit be paranoia on my part already ?

 

[harlan4096]

Yes

 

[M4RT1NE2]

Simple system hardening requires configuration? Or does it just install and forget?

I was disappointed with Aomei Backupper yesterday. I had the one year version from a promotion. I could not run the program - it ended up with a blue screen.

I removed it and installed Macrium Reflect Free

 

[L0ckJaw]

Proste utwardzanie systemu wymaga konfiguracji?. A może po prostu zainstaluj i zapomnij?

Wczoraj byłem rozczarowany Aomei Backupperem. Miałem roczną wersję z promocji. Nie mogłem uruchomić programu - skończyło się niebieskim ekranem.

Usunąłem go i zainstalowałem Macrium Reflect Free

Install and sometimes check it.

I am using it together with Bitdefender Total Security, rock solid combination.

New Update - Simple Windows Hardening

Post updated in September 2024. SWH works with Windows 10 and 11 (all versions including 24H2) SWH ver. 2.1.1.1 - July 2023 (added support for Windows 11 ver. 22H2) https://github.com/AndyFul/Hard_Configurator/raw/master/Simple%20Windows%20Hardening/SimpleWindowsHardening_2111.zip SWH ver...

malwaretips.com

 

[silversurfer]

Wouldn't adding simple windows hardening to my security kit be paranoia on my part already ?

Voodoo Shield free helps to protect in similar way like OS hardening but offers more "features" as real-time protection.
Simple Windows Hardening does work with tweaks only to harden Windows 10/11
Both together it's what we call "overkill" but in my view slightly overkill

Yes.
Simple System Hardening requires some special setup ?. Or just install and forget?

Just turn on SRP. You can may change a few details on Windows Hardening.

 

[M4RT1NE2]

Added Simple Windows Hardening

 

[Gandalf_The_Grey]

I agree with @silversurfer it's a little bit overkill and it depends on what you want.

Simple Windows Hardening is passive, set and forget, when something gets blocked look at the logs.
From Andy's GitHub page:

Spoiler: Quick configuration

1. Run SWH - the restrictions are automatically configured.
2. Log OFF the account or reboot is required, depending on what restrictions were applied before running SWH.
3. If MS Office is installed, then it is recommendable to make some additional hardening:
   • open Excel and block macros without notification (do it on each user account),
   • apply in SWH the "Paranoid Extensions" (Settings >> Protected SRP Extensions).
   • This is not necessary when ASR rules for MS Office, Adobe Reader, and WMI are enabled with Microsoft Defender as the main Antivirus. The ASR rules can be configured by using the ConfigureDefender tool: ConfigureDefender/H_C_HardeningTools at master · AndyFul/ConfigureDefender
4. If necessary, then also other applications from the H_C_HardeningTools repository can be used to increase the security (RunBySmartScreen, FirewallHardening, and DocumentsAntiExploit).

Please keep updated your system/software. Use SWH on the default settings for some time, until you will be accustomed to it. Most users will probably do not see any difference, but rarely a legal script or file with unsafe extension will be blocked by SWH settings. You can use blue buttons View Blocked Events and Manage the Whitelist to recognize and whitelist the blocked files. Please be careful, if you are not certain that the blocked file is safe, then wait one day or two before whitelisting it.

Hard_Configurator/Simple Windows Hardening at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

VoodooShield is active protection and will inform you when something gets blocked.

I would choose one or the other.

 

[M4RT1NE2]

I agree with @silversurfer it's a little bit overkill and it depends on what you want.

Simple Windows Hardening is passive, set and forget, when something gets blocked look at the logs.
From Andy's GitHub page:

Spoiler: Quick configuration

1. Run SWH - the restrictions are automatically configured.
2. Log OFF the account or reboot is required, depending on what restrictions were applied before running SWH.
3. If MS Office is installed, then it is recommendable to make some additional hardening:
   • open Excel and block macros without notification (do it on each user account),
   • apply in SWH the "Paranoid Extensions" (Settings >> Protected SRP Extensions).
   • This is not necessary when ASR rules for MS Office, Adobe Reader, and WMI are enabled with Microsoft Defender as the main Antivirus. The ASR rules can be configured by using the ConfigureDefender tool: ConfigureDefender/H_C_HardeningTools at master · AndyFul/ConfigureDefender
4. If necessary, then also other applications from the H_C_HardeningTools repository can be used to increase the security (RunBySmartScreen, FirewallHardening, and DocumentsAntiExploit).

Please keep updated your system/software. Use SWH on the default settings for some time, until you will be accustomed to it. Most users will probably do not see any difference, but rarely a legal script or file with unsafe extension will be blocked by SWH settings. You can use blue buttons View Blocked Events and Manage the Whitelist to recognize and whitelist the blocked files. Please be careful, if you are not certain that the blocked file is safe, then wait one day or two before whitelisting it.

Hard_Configurator/Simple Windows Hardening at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

VoodooShield is active protection and will inform you when something gets blocked.

I would choose one or the other.

I will leave two for now - VS and SWH. I'll keep watching. I do not use MS Office

 

[Gandalf_The_Grey]

I will leave two for now - VS and SWH. I'll keep watching. I do not use MS Office

That's fine.
For me the only issue would be troubleshooting.
If something doesn't work, it could be your AV, SWH or VS that's blocking it.

 

[M4RT1NE2]

As of today, I already have everything I need to work safely on my laptop.
Since I'm with you on the forum, my software has changed completely. I don't mean just laptop security anymore, but also other programs - replacements for the original ones.
Thanks to your advice I managed to make an interesting set
I am pleased with this fact

 

[M4RT1NE2]

SWH removed today - makes no sense with VS.
Thanks Gandalf_The_Grey

A small change in browsing.

Instead of Chrome, I have Firefox. So out of boredom I haven't had Firefox in a long time.

Any special configurations needed?

 

[harlan4096]

You may try: Enhanced Tracking Protection -> Strict

 

[M4RT1NE2]

I set it up but I don't know if it will be a good move - if the pages will work properly. So far so good

Something else to change ?

 

[harlan4096]

Disable telemetry:



Check if only-HTTS Mode is enabled, You may also enable DNS over HTTS:

 

[M4RT1NE2]

Telemetry disabled.
I cannot change DNS (maybe because I use NextDNS ?).

EDIT:

I feel Firefox is much faster than Chrome

 

[harlan4096]

In my FF you can set NextDNS, it comes as one of the predefined settings:

 

[Kongo]

I set it up but I don't know if it will be a good move - if the pages will work properly.

SmartBlock for Enhanced Tracking Protection | Firefox Help

SmartBlock lets pages load more fully, with less breakage — all while keeping those tracking scripts blocked.

support.mozilla.org

You shouldn't experience a lot of breakages.

 

[M4RT1NE2]

I used this procedure to disable telemetry in Firefox

devtools.onboarding.telemetry.logged = false
toolkit.telemetry.updatePing.enabled = false
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.newtabpage.activity-stream.telemetry = false
browser.ping-centre.telemetry = false
toolkit.telemetry.bhrPing.enabled = false
toolkit.telemetry.enabled = false
toolkit.telemetry.firstShutdownPing.enabled = false
toolkit.telemetry.hybridContent.enabled = false
toolkit.telemetry.newProfilePing.enabled = false
toolkit.telemetry.reportingpolicy.firstRun = false
toolkit.telemetry.shutdownPingSender.enabled = false
toolkit.telemetry.unified = false
toolkit.telemetry.updatePing.enabled = false
toolkit.telemetry.reportingpolicy.firstRun = false
toolkit.telemetry.unified = false
toolkit.telemetry.archive.enabled = false
devtools.onboarding.telemetry.logged = false
toolkit.telemetry.bhrPing.enabled = false
datareporting.healthreport.uploadEnabled = false
datareporting.policy.dataSubmissionEnabled = false
datareporting.sessions.current.clean = true
datareporting.healthreport.uploadEnabled = false
datareporting.policy.dataSubmissionEnabled = false
datareporting.sessions.current.clean = true

 

[M4RT1NE2]

In my FF you can set NextDNS, it comes as one of the predefined settings:

View attachment 265951

I don't see that and myself in FF

 

[harlan4096]

Maybe because You already using it?