Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1075930" data-attributes="member: 32260">
<ol>
<li data-xf-list-type="ol">Most of the ConfigureDefender settings are related only to Microsoft Defender. WDAC ISG works with other AVs.</li>
<li data-xf-list-type="ol">ConfigureDefender MAX settings protect all locations (with a few exclusions). WDAC ISG automatically allows Non-writable locations and WDAC whitelisted locations. 
The exclusions made via ConfigureDefender are ignored by WDAC.</li>
<li data-xf-list-type="ol">The&nbsp; 0-day protection for EXE files in ConfigureDefender MAX settings is mainly related to the ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot;.&nbsp; It works similarly to WDAC ISG without SmartScreen backend and only for a short time (usually 24 hours) from the moment when the sample is recognized for the first time in the Microsoft cloud.</li>
<li data-xf-list-type="ol">WDAC ISG policy can block MSI files and DLLs, but ConfigureDefender settings cannot.</li>
<li data-xf-list-type="ol">When the Internet connection is turned OFF, WDAC will still block new files. Some ConfigureDefender settings (like the ASR rule from point 3) require an Internet connection.</li>
</ol>Probably yes. The first version of WHHLight used a different WDAC policy which can produce an error. Another reason can be related to 3rd part security software.Please use Menu &gt;&gt; Restore Windows Defaults, run WHHLight again, and switch &lt; WDAC &gt; to ON.Please let me know if there will be any alerts.</blockquote>

[QUOTE="Andy Ful, post: 1075930, member: 32260"] [LIST=1] [*]Most of the ConfigureDefender settings are related only to Microsoft Defender. WDAC ISG works with other AVs. [*]ConfigureDefender MAX settings protect all locations (with a few exclusions). WDAC ISG automatically allows Non-writable locations and WDAC whitelisted locations. The exclusions made via ConfigureDefender are ignored by WDAC. [*]The 0-day protection for EXE files in ConfigureDefender MAX settings is mainly related to the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria". It works similarly to WDAC ISG without SmartScreen backend and only for a short time (usually 24 hours) from the moment when the sample is recognized for the first time in the Microsoft cloud. [*]WDAC ISG policy can block MSI files and DLLs, but ConfigureDefender settings cannot. [*]When the Internet connection is turned OFF, WDAC will still block new files. Some ConfigureDefender settings (like the ASR rule from point 3) require an Internet connection. [/LIST] Probably yes. The first version of WHHLight used a different WDAC policy which can produce an error. Another reason can be related to 3rd part security software. Please use Menu >> Restore Windows Defaults, run WHHLight again, and switch < WDAC > to ON. Please let me know if there will be any alerts. [/QUOTE]

Verification