Using Hard_Configurator in HARDENEDmode with ConfigureDefender in HIGHEST protection on Windows10

[oldschool]

If you use SUA that was not a mistake. Although, restoring the system was unnecessary. See my edited post:
https://malwaretips.com/threads/usi...est-protection-on-windows10.92678/post-816173

This was my case and I acted in haste before you had posted. Lesson learned: Breathe, wait patiently, consider the problem, etc. ... !

 

[camo7782]

In the proposed setup, the remote access is allowed to the computer. It is much safer to disable it (<Block Remote Access> = ON). Most home users do not use remote features at all.

will this disable also apps such as TeamViewer and AnyDesk?

 

[Andy Ful]

will this disable also apps such as TeamViewer and AnyDesk?

Yes.

Edit.
I was wrong:
https://malwaretips.com/threads/usi...est-protection-on-windows10.92678/post-816626

 

[camo7782]

@Andy Ful is it possible to only disable windows remote desktop or do something to allow for example AnyDesk?

 

[shmu26]

I have remote access blocked, and I can still use TeamViewer. I have the regular, free version of TeamViewer, not the portable.

 

[Gandalf_The_Grey]

I have remote access blocked, and I can still use TeamViewer. I have the regular, free version of TeamViewer, not the portable.

Same here with the app of Teamviewer from the Microsoft Store and remote access blocked.

 

[Andy Ful]

@Andy Ful is it possible to only disable windows remote desktop or do something to allow for example AnyDesk?

I think that AnyDesk uses Remote Desktop but I test it and we will see.

 

[Andy Ful]

@Andy Ful is it possible to only disable windows remote desktop or do something to allow for example AnyDesk?

I was wrong. AnyDesk installs its own version of Remote Desktop service named: 'AnyDesk Service'. So it should work with disabled Windows built-in remote features.
The same is probably true for TeamViewer.

 

[camo7782]

Thanks for a nice review.
Although I have to add some corrections.

[...]

The closest to @Windows_Security proposition with allowed EXE files, would be the profile in attachment, which I named: Windows_Security_hardening.hdc.txt (download - delete .txt - load to H_C - enjoy).

The attachment is identical to the one in the first post from @Windows_Security was it updated? I do not see any difference..

 

[Andy Ful]

The attachment is identical to the one in the first post from @Windows_Security was it updated? I do not see any difference..

Yes, now they are identical.

 

[Windows_Security]

I used same settings which I figured out when Vista was introduced. @Andy Ful was so nice to develop a program with GUI so people did not have to hack the registry. These made the free Windows OS security features accessible to many more security enthousiast. This knowledge rewards him the master title san.

Andy-San also researched and updated the software policies for all/current Windows OS versions AND added Windows Defender and Rich Document (containing scripts/macros) protection (and Windows Firewall to follow). These enduring efforts granted him the other master title Sensei.

Obviously I copied the corrections of Andy Sensei San in my post.

 

[Andy Ful]

I used same settings which I figured out when Vista was introduced. @Andy Ful was so nice to develop a program with GUI so people did not have to hack the registry. These made the free Windows OS security features accessible to many more security enthousiast. This knowledge rewards him the master title san.

Andy-San also researched and updated the software policies for all/current Windows OS versions AND added Windows Defender and Rich Document (containing scripts/macros) protection (and Windows Firewall to follow). These enduring efforts granted him the other master title Sensei.

Obviously I copied the corrections of Andy Sensei San in my post.

You must have Samurai roots for sure.
I like sensei:

 

[thrillskr]

@Andy Ful 100 lat ! dziękuję badrzo !

 

[Andy Ful]

View attachment 214719

@Andy Ful 100 lat ! dziękuję badrzo !

Moje ulubione, na zdrowie.
(My favorite, cheers).

 

[Andy Ful]

Here is a simple method to use H_C with UAC setting 'Only elevate executables that are signed and validated'.
Normally with this setting, the user cannot run H_C executable because it is not digitally signed and will be blocked while trying to elevate.
But, it can be done by running first the elevated command prompt with a command line to start H_C. Simply create the shortcut on the Desktop with the below command line:

For Windows 64-bit:

C:\Windows\System32\cmd.exe /c start c:\Windows\Hard_Configurator\Hard_Configurator(x64).exe

For Windows 32-bit:

C:\Windows\System32\cmd.exe /c start c:\Windows\Hard_Configurator\Hard_Configurator(x86).exe

Now the shortcut should be executed by using the usual "Run as administrator" option from the Explorer context menu, and this will also run H_C.

Please note, that Windows_Security profile is for the Admin account, and Standard User Account is additionally restricted to disable elevation of all user programs, so command prompt will not be allowed to elevate (and H_C will not be executed anyway).
If someone wants to use these shortcuts on SUA, then the below option must be set:
<More ...> <Disable Elevation on SUA> = OFF

 

[shmu26]

Here is a simple method to use H_C with UAC setting 'Only elevate executables that are signed and validated'.
Normally with this setting, the user cannot run H_C executable because it is not digitally signed and will be blocked while trying to elevate.
But, it can be done by running first the elevated command prompt with a command line to start H_C. Simply create the shortcut on the Desktop with the below command line:

For Windows 64-bit:

C:\Windows\System32\cmd.exe /c start c:\Windows\Hard_Configurator\Hard_Configurator(x64).exe

For Windows 32-bit:

C:\Windows\System32\cmd.exe /c start c:\Windows\Hard_Configurator\Hard_Configurator(x86).exe

Now the shortcut should be executed by using the usual "Run as administrator" option from the Explorer context menu, and this will also run H_C.

Please note, that Windows_Security profile is for the Admin account, and Standard User Account is additionally restricted to disable elevation of all user programs, so command prompt will not be allowed to elevate (and H_C will not be executed anyway).
If someone wants to use these shortcuts on SUA, then the below option must be set:
<More ...> <Disable Elevation on SUA> = OFF

Thanks for the great idea!

 

[silversurfer]

I tried a similar command line to start FirewallHardening.exe, it also works successfully

C:\Windows\System32\cmd.exe /c start c:\Windows\Hard_Configurator\FirewallHardening(x64).exe

 

[shmu26]

Wait a minute... if I enable 'Only elevate executables that are signed and validated' then I can't right-click a file and use Run As Smartscreen, correct?
Okay, my bad. I tried it on a file that is not signed. It still seems to work on signed files.

 

[Andy Ful]

Wait a minute... if I enable 'Only elevate executables that are signed and validated' then I can't right-click a file and use Run As Smartscreen, correct?
Okay, my bad. I tried it on a file that is not signed. It still seems to work on signed files.

Yes, when using the H_C Recommended settings, you can run only signed executables in this way (via Run As SmartScreen from Explorer context menu). That is why the UAC setting 'Only elevate executables that are signed and validated', was not implemented in H_C. This would block the execution of unsigned application installers, which is unnecessary because they are elevated only after SmartScreen check. I do not think this UAC setting useful with H_C Recommended settings.

With H_C Windows_Security profile, you can run additionally the unsigned executables if they do not need to elevate. This profile does not require whitelisting applications in UserSpace, so it is easier to manage.
It is worth to remember that the UAC setting 'Only elevate executables that are signed and validated', will block application updates if the updater is not digitally signed and requires admin rights.

 

[shmu26]

I do not think this UAC setting useful with H_C Recommended settings.

Yeah, I see what you mean. It is not an absolute block (it can be easily bypassed by elevated command prompt), and we have Run As SmartScreen, which is pretty reliable for unsigned files, so this UAC setting is probably more trouble than it's worth, with H_C Recommended settings.