oldschool

Level 28
Verified
I did this to restore defaults on a pc so I could use a program that needed a script (checking for specter/meltdown patches). Everything seemed fine until I could no longer open ConfigureDefender. I don’t know what setting it changed, but it was not changed to the value it was originally set at. I’m a bit wary of Syshardener now. I used the default values plus PowerShell constrained language. I was just surprised that restoring defaults broke CD. I reimaged and just cranked up OSArmor for now.
Do you use only Admin account or do you also have an SUA? As @shmu26 said, you would have to restore defaults in all accounts for SysHardener. Oh well, at least you were able to re-image. I learned it is best not to use certain apps or features if I am uncertain of the consequences.
 

Decopi

Level 2
SysHardener has many hardening .... because it blocks over 80% of malware delivery pahs, used in the wild by cybercriminals.
Hi @Andy Ful ,

First, thank you for your useful posts. I learn a lot from you.

Please, I have a request: If possible, please post the images with your SH' recommendations (suggested by you on past 02/26).

You pointed some general categories to block at SH. But SH doesn't speak exactly with your words, and ignorant newbies like me may confuse things. For example, at your post, some categories are easy to identify, but "block/restrict scripts and script Interpreters"... I have no idea what is it. LOLBins, the same.

For ignorant newbies like me, I believe that posting the images with your recommendation, it will be much better than you using words.

Thanks in advance!
 

blackice

Level 6
Do you use only Admin account or do you also have an SUA? As @shmu26 said, you would have to restore defaults in all accounts for SysHardener. Oh well, at least you were able to re-image. I learned it is best not to use certain apps or features if I am uncertain of the consequences.
One of the reasons I gave it a shot is I knew I could just re-image. I still may try it again. I almost never need scripts. I figured select all and restore was practical. What would be better is a snapshot so you could restore your pre-Syshardener settings. Which I guess would be the system restore point. Those files get big, though. I agree about using software you don’t understand being unadvisable sometimes. But I understood the default tweaks for the most part, and why the script wouldn’t run. It was the restoring defaults breaking things that surprised me.
 

Andy Ful

Level 42
Content Creator
Trusted
Verified
Hi @Andy Ful ,

First, thank you for your useful posts. I learn a lot from you.

Please, I have a request: If possible, please post the images with your SH' recommendations (suggested by you on past 02/26).

You pointed some general categories to block at SH. But SH doesn't speak exactly with your words, and ignorant newbies like me may confuse things. For example, at your post, some categories are easy to identify, but "block/restrict scripts and script Interpreters"... I have no idea what is it. LOLBins, the same.

For ignorant newbies like me, I believe that posting the images with your recommendation, it will be much better than you using words.

Thanks in advance!
I have a problem with suggesting advanced SysHardener settings to newbies. So let's make it clear. My suggestions are not for them, but a least for semi-advanced users. Anyway, I do not think that you are a newbie (like most of MT members).:giggle:
213785
213786
213787
213788
213789
213790
213797
213798
213799

The outbound rules are for SysHardener ver. 1.5 (ver. 1.4 has fewer rules).

To restore the default Windows settings use <Un/Select All><Select All> and after selecting all options press <Restore Selected>.
Be safe.
 
Last edited:

Decopi

Level 2
Fantastic @Andy Ful ! Thank you.

Yeah, I didn't expect your recommendations for newbies. I always will expect your own recommendations, independently on user level.

Please, another simple question. I am on SH V1.5, and I have some options, that if possible, I would like your confirmation to select or un-select:
Turn off server (LanmanServer) Service
Block Outbond Connections for Expand.exe
Block Outbond Connections for Ftp.exe
Block Outbond Connections for Print.exe
Block Outbond Connections for Replace.exe
Block Outbond Connections for Telnet.exe
Block Outbond Connections for Tfp.exe

Changing subject and last question for you: I know your are a kind of expert on UAC, SmartScreen etc. But I have Comodo Firewall with CS' settings, and there auto-containment only virtualizes if UAC is disabled (so I disabled). The last two years I have this settings, I tested a lot with tons of updated malwares, pests, phishing etc, and never had a problem, CF/CS blocked everything. But I am not an expert, you are the expert, so please let me exploit the opportunity to ask your opinion: With CF/CS... UAC enabled or disabled? Do you prefer hardening UAC/Windows rather than CF/CS or similar alternatives?

Again, thanks in advance!
 

Andy Ful

Level 42
Content Creator
Trusted
Verified
"Turn off server (LanmanServer) Service" - this one is risky, but can be used temporarily when you are connected to Public Network. Anyway, If you have no issues, then you can keep it.
Personally, on Windows 7 I like both CF/CS and H_C. For many users, CF/CS will be more friendly because of Trusted Vendor List.
On Windows 10, I prefer H_C for compatibility reasons.
 
Last edited:

oldschool

Level 28
Verified
One of the reasons I gave it a shot is I knew I could just re-image. I still may try it again. I almost never need scripts. I figured select all and restore was practical. What would be better is a snapshot so you could restore your pre-Syshardener settings. Which I guess would be the system restore point. Those files get big, though. I agree about using software you don’t understand being unadvisable sometimes. But I understood the default tweaks for the most part, and why the script wouldn’t run. It was the restoring defaults breaking things that surprised me.
I am still surprised that Select All > Restore Selected did not work for you. :unsure: Remember that NVT makes a lot of freeware so expectations for features should be tempered. Andreas changes/fixes what he likes, as it should be, e.g. I think scrolling was jumpy in SH and he may have fixed that.
 

blackice

Level 6
I am still surprised that Select All > Restore Selected did not work for you. :unsure: Remember that NVT makes a lot of freeware so expectations for features should be tempered. Andreas changes/fixes what he likes, as it should be, e.g. I think scrolling was jumpy in SH and he may have fixed that.
That’s why I’m probably going to give it another shot. I’ll just leave it at default and use OSArmor for all advanced blocking since that is way easier to reverse.
 
  • Like
Reactions: oldschool