Advanced Security oldschool's cheapo laptop configuration

[blackice]

Taking Kaspersky Free for a test drive.

You just couldn’t resist.

 

[brambedkar59]

Taking Kaspersky Free for a test drive.

Don't forget to disable Kaspersky news, it keeps popping from time to time if you don't.

Spoiler

How do I disable the News notifications in Kaspersky Free?

A green envelope appears in my Windows 7 system tray and it won't go away until I've clicked on it and read the news. The news items are things unrelated to my Kaspersky Free installation so I have no interest in it. The support article below tells me how to disable the news but it's referring to...

forum.kaspersky.com

 

[oldschool]

Don't forget to disable Kaspersky news, it keeps popping from time to time if you don't.

I don't need to, the reason being that I tried to disable web scanning and the UI froze and locked my machine. One of the shortest test drives ever. What was I thinking? Bye bye Kaspersky, hello MS Defender.

 

[blackice]

I don't need to, the reason being that I tried to disable web scanning and the UI froze and locked my machine. One of the shortest test drives ever. What was I thinking? Bye bye Kaspersky, hello MS Defender.

Bitdefender in 5.

 

[oldschool]

Switched to Bing in Edge after hearing @mlnevese 's report of improved search results.

 

[SHvFl]

Switched to Bing in Edge after hearing @mlnevese 's report of improved search results.

Biggest issue with bing is you search for something; you scroll down and click a link and guess what. When you go back at search you are not at the spot you clicked but at the top of the page. People even made scripts for it, but MS is still sleeping on a fix. I bet they say it's a feature and not a bug.

 

[WhiteMouse]

Switched to Bing in Edge after hearing @mlnevese 's report of improved search results.

It's not that Bing is improved but Google's SEO is abused and phising ads on top of that.

 

[oldschool]

Installed the Moment 5 feature update without issue.

Edited security configuration for accuracy.

 

[ForgottenSeer 107474]

Installed the Moment 5 feature update without issue.

Edited security configuration for accuracy.

When I recall right (at least I thought I have read that, so apologize when wrong) you used to set software restriction policies and defender settings through Group Policy. In your current setup it is not mentioned, so either I am wrong or you have not mentioned that anymore?

 

[oldschool]

When I recall right (at least I thought I have read that, so apologize when wrong) you used to set software restriction policies and defender settings through Group Policy. In your current setup it is not mentioned, so either I am wrong or you have not mentioned that anymore?

Yes, I use GPO to configure MS Defender. I had SRP configured but it didn't seem to work, i.e. I didn't have to whitelist anything, so I'm not using it.

Edited configuration details to include above info plus Cloudfare Malware DNS and Brave Search in Edge.

 

[ForgottenSeer 109138]

Yes, I use GPO to configure MS Defender. I had SRP configured but it didn't seem to work, i.e. I didn't have to whitelist anything, so I'm not using it.

Edited configuration details to include above info plus Cloudfare Malware DNS and Brave Search in Edge.

Windows 11 no longer supports SRP.

 

[ForgottenSeer 107474]

Windows 11 no longer supports SRP.

There is a setting you can change to enable it again. Found it here on MT. I am running SRP on Windows 11

@oldschool better ask Andy Ful when you want to know what setting to change

 

[ForgottenSeer 109138]

There is a setting you can change to enable it again. Found it here on MT. I am running SRP on Windows 11

@oldschool better ask Andy Ful when you want to know what setting to change

Interesting because last I knew MS was no longer developing SRP in group policy but instead using applocker or WDAC.

 

[oldschool]

There is a setting you can change to enable it again. Found it here on MT. I am running SRP on Windows 11

@oldschool better ask Andy Ful when you want to know what setting to change

Bump @Andy Ful

 

[ForgottenSeer 107474]

I think I found it: Software Restriction Policies (SAFER) still possible under Windows 11 22H2 …

 

[ForgottenSeer 109138]

I think I found it: Software Restriction Policies (SAFER) still possible under Windows 11 22H2 …

View attachment 282665

There is this of course, right from the horses mouth. Although I have read that not only is it depreciated but gutted as well.

The Kanthak correction to restore SRP functionality on Windows 11 ver. 22H2, works only when Smart App Control is OFF. If it is in Evaluate or ON mode, then the invalid registry values are automatically restored after restarting Windows.
To restore SRP on all SAC modes, one should not delete registry values but simply set the "RuleCount" value to 0:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000000

Windows restart is required.

Regards:
@Andy Ful (developer of Hard_Configurator)

 

[oldschool]

Configured a basic disallowed policy for SRP.

 

[oldschool]

@Andy Ful

Windows Security is broken with my SRP setup. I whitelisted as below without success.

\\?\C:\Windows\System32\SecurityHealthHost.exe

Where to add path * wildcards you mention below?

The path should be whitelisted. But it includes wildcards, so <Add Path*Wildcards> has to be used.

 

[Andy Ful]

@Andy Ful

Windows Security is broken with my SRP setup. I whitelisted as below without success.

Where to add path * wildcards you mention below?

I am not sure what you want to whitelist and if you want to use H_C for something?
In H_C the below path is whitelisted:
\\?\C:\WINDOWS\system32

 

[oldschool]

Change back to Quad9 DNS from Cloudfare Malware DNS after using the latter for a couple of weeks. Quad9 clearly wins hands-down.