New Update Simple Windows Hardening

[Semlr]

@Semlr,
Could you please test if this issue is also present for some other applications:

Hard_Configurator/Hard_Configurator_setup_5.1.1.2.exe at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - Hard_Configurator/Hard_Configurator_setup_5.1.1.2.exe at master · AndyFul/Hard_Configurator

github.com

ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

Utility for configuring Windows 10 built-in Defender antivirus settings. - ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

github.com

Thank you.

What version of a virtual machine do you use?

Thanks for your response.
Here are my results:

Hard_Configurator:

• Same error

ConfigureDefender-repo (hardening tools?):

• Configuire Defender started just fine,
• DocumentsAntiExploits same error,
• Network hardening startet just fine.

VM:
Hyper V, Gen2-setup:
client:

& Kaspersky Antivirus (just as a sidenote, it did not interfere)

 

[oldschool]

Did anyone had this issue on the real system? I tried to reproduce this issue on my Windows Pro ver. 2004 compilation 19041.388, but SWH works without any issues.

I've tried it on my machine with Windows Pro 2004 and no problems whatsoever. Very nice app. Thanks!

 

[Andy Ful]

Thanks for your response.
Here are my results:

Hard_Configurator:

• Same error

ConfigureDefender-repo (hardening tools?):

• Configuire Defender started just fine,
• DocumentsAntiExploits same error,
• Network hardening startet just fine.

VM:
Hyper V, Gen2-setup:
client:
View attachment 244997
& Kaspersky Antivirus (just as a sidenote, it did not interfere)

Thanks. I am trying to reproduce this issue on the official Hyper-V Windows 10 Enterprise Evaluation ver. 2004 build 19041.329, but everything works well. Anyway, this is Hyper-V Gen 1.
Do you have a link to the official Gen 2 Hyper-V Windows 10 virtual machine?

 

[ErzCrz]

I don't have time this evening to do any testing but is there anything in the H_C or SW logs? Interesting it was affected by Document Exploit.

 

[Andy Ful]

I don't have time this evening to do any testing but is there anything in the H_C or SW logs? Interesting it was affected by Document Exploit.

From what I understood, the H_C and SWH did not start properly.

 

[Semlr]

Thanks. I am trying to reproduce this issue on the official Hyper-V Windows 10 Enterprise Evaluation ver. 2004 build 19041.329, but everything works well. Anyway, this is Hyper-V Gen 1.
Do you have a link to the official Gen 2 Hyper-V Windows 10 virtual machine?

I created a new vm and installed windows 10 pro 2004 using the official iso (created by media creation tool).
Is it possible to collect a trace log or stack trace for autoit-scripts?
Currently we only know the line number (32692), if this is accurate.

 

[Andy Ful]

I created a new vm and installed windows 10 pro 2004 using the official iso (created by media creation tool).
Is it possible to collect a trace log or stack trace for autoit-scripts?
Currently we only know the line number (32692), if this is accurate.

The final Autoit executable contains the code made by developer + many Autoit built-in functions added in the process of compilation. It is possible to decompile 32-bit executables via Exe2Aut tool. But, you have 64-bit version.
It is probably possible to install Autoit in the VM and run the script (without compilation). Then the error will show the line in the concrete Autoit function.

 

[Andy Ful]

I created a new vm and installed windows 10 pro 2004 using the official iso (created by media creation tool).
...

I have just finished testing on the VM like the above one - no problems. So, it seems that the only way to identify the issue is to run the source scripts (not compiled) on your virtual machine.
If you would like to do this, then you can use the source from:

Hard_Configurator/src/Hard_Configurator.zip at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

The archive has to be unpacked to the Windows folder so the scripts will be placed in the folder: c:\Windows\Hard_Configurator .
Installation of Autoit is necessary:

https://www.autoitscript.com/autoit3/files/archive/autoit/autoit-v3.3.14.2-setup.exe

For testing H_C and DocumentsAntiExploit the below scripts can be run from the Explorer:
c:\Windows\Hard_Configurator\Hard_Configurator.au3
c:\Windows\Hard_Configurator\DocumentsAntiExploit.au3
These scripts use other files so all source scripts are required in the Hard_Configurator folder.

 

[Semlr]

Thank you for the guideline.
I executed the DocumentsAntiExploit.au3 and
I found a clue:

The logged on user does not have administrator rights (standard user).
Admin rights are granted by another user account which is local administrator.
Maybe this "mismatch" (logged on user vs user which granted admin rights) cause this error?

 

[Andy Ful]

Thank you for the guideline.
I executed the DocumentsAntiExploit.au3 and
I found a clue:
View attachment 245015

The logged on user does not have administrator rights (standard user).
Admin rights are granted by another user account which is local administrator.
Maybe this "mismatch" (logged on user vs user which granted admin rights) cause this error?

I forgot that the archive is password protected :
hard_configurator5111

This function works well (both on Admin Account or SUA) and normally the variable $User[0] contains the SID of the Current User. I think that probably some security prevents reading the SID.

Please replace the function _GetCurrentUserSID() with this code:

Func _GetCurrentUserSID()
    Local $User = _Security__LookupAccountName(_GetCurrentUser(),@ComputerName)
    If @error Then Return SetError(1,0,"")
    Return 1
;    Return $User[0]
EndFunc

But do not apply restrictions.

 

[Andy Ful]

@Semlr,
Thanks for the support. I will add an alert about such an event and the program will gently exit, instead of showing the error.
The CurrentUser SID is essential only for DocumentsAntiExploit tool, and the code related to _GetCurrentUserSID can be removed in actual versions of H_C, SwitchDefaultDeny, and SWH.

 

[Lenny_Fox]

After a month of trying it out on my desktop with windows defender on MAX (with protected folders enabled) running as standard user, I installed identical config on my girlfriends laptop.

Security becomes tedious and dull wilt Andy Full's hardening tools. NO PROBLEMS, NO INFECTIONS, NO POPUPS, NO INCOMPATIBILITIES

 

[Andy Ful]

After a month of trying it out on my desktop with windows defender on MAX (with protected folders enabled) running as standard user, I installed identical config on my girlfriends laptop.

Security becomes tedious and dull wilt Andy Full's hardening tools. NO PROBLEMS, NO INFECTIONS, NO POPUPS, NO INCOMPATIBILITIES

Yes, this setup can be used on many machines with popular software (high prevalence).
Anyway, the WD MAX Protection Level can produce some problems for people who like to try many applications, especially not very popular ones. A few ASR rules can produce problems, for example on laptops with firmware that uses WMI.
Controlled Folder Access can produce strange alarms ( “Protected memory access blocked” ) for applications that try to access the disk on the low level (usually disk cleaners, backup applications, etc.).

 

[Lenny_Fox]

Yes, this setup can be used on many machines with popular software (high prevalence).
Anyway, the WD MAX Protection Level can produce some problems for people who like to try many applications, especially not very popular ones. A few ASR rules can produce problems, for example on laptops with firmware that uses WMI.
Controlled Folder Access can produce strange alarms ( “Protected memory access blocked” ) for applications that try to access the disk on the low level (usually disk cleaners, backup applications, etc.).

It is a lenovo Yoga, she does not install software and WD runs on MAX for at least two years now without problems. The memory access blocked don't give problems either.

 

[pxxb1]

Hi

I just installed SWH in Shadow defender mode, and i can not find it on the Pc to manage the GUI. What to do?

What does the "Windows Hardening" feature actually do, what features does it contain?

 

[Andy Ful]

Hi

I just installed SWH in Shadow defender mode, and i can not find it on the Pc to manage the GUI. What to do?

What does the "Windows Hardening" feature actually do, what features does it contain?

SWH is a portable application.
Read the first post in this thread for more info.

 

[ErzCrz]

Hi

I just installed SWH in Shadow defender mode, and i can not find it on the Pc to manage the GUI. What to do?

What does the "Windows Hardening" feature actually do, what features does it contain?

Q&A - Simple Windows Hardening it's similar to Hard_Configurator but for less advanced users.

 

[pxxb1]

SWH is a portable application.
Read the first post in this thread for more info.

Ok, now i see how to do.

Is it possible to get a notice when something is blocked instead of the silent d.o like now?

I am thinking of changing from NVT` s Syshardener to SWH but, it seems to me that Syshardener gives more protection. Am i right?

 

[Andy Ful]

...
Is it possible to get a notice when something is blocked instead of the silent d.o like now?

When something is blocked, then usually you get the Windows alert. The details can be seen in the SWH Log. Some actions are rarely blocked by Windows without alert (like in SysHardener).

I am thinking of changing from NVT` s Syshardener to SWH but, it seems to me that Syshardener gives more protection. Am i right?

SysHardener default settings are not so restrictive as the SWH default setup. So, usually the opposite is true.

You can make SysHardener stronger by ticking all options, but this is not recommended because SysHardener does not have a log of blocked processes, so you will have problems with identifying what setting is the issue. It does not also allow whitelisting, so one blocked BAT script required to run Intel or AMD firmware, will cause you to disable protection of all BAT scripts, etc.

Most of these problems can be solved when using SWH + FirewallHardening. The FirewallHardening tool is an enhanced version of the SysHardener part related to blocking Internet access to LOLBins:

ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

Utility for configuring Windows 10 built-in Defender antivirus settings. - ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

github.com

This setup is stronger and safer for the user than tweaked SysHardener, because of using detailed Logs and whitelisting.

If you need simple and basic protection (no whitelisting), then you can use SysHardener on default settings. If you need something stronger and more comprehensive then go for SWH.

 

[pxxb1]

When something is blocked, then usually you get the Windows alert. The details can be seen in the SWH Log. Some actions are rarely blocked by Windows without alert (like in SysHardener).

SysHardener default settings are not so restrictive as the SWH default setup. So, usually the opposite is true.

You can make SysHardener stronger by ticking all options, but this is not recommended because SysHardener does not have a log of blocked processes, so you will have problems with identifying what setting is the issue. It does not also allow whitelisting, so one blocked BAT script required to run Intel or AMD firmware, will cause you to disable protection of all BAT scripts, etc.

Most of these problems can be solved when using SWH + FirewallHardening. The FirewallHardening tool is an enhanced version of the SysHardener part related to blocking Internet access to LOLBins:

ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

Utility for configuring Windows 10 built-in Defender antivirus settings. - ConfigureDefender/H_C_HardeningTools.zip at master · AndyFul/ConfigureDefender

github.com

This setup is stronger and safer for the user than tweaked SysHardener, because of using detailed Logs and whitelisting.

If you need simple and basic protection (no whitelisting), then you can use SysHardener on default settings. If you need something stronger and more comprehensive then go for SWH.

I see.

To sum it up. You mean that SWH is better because it logs and blocks and together with FH the protection is enhanced so it is equal to, or better, than SH?