Advice Request Which apps to whitelist in Simplewall to keep system secure?

[JordanMason8]

Hi,

I use Simplewall to whitelist apps which are allowed to connect to the internet. Since Windows has quite some privacy-invasive behavior by-default, I would like to only allow apps which strictly need it for security purposes. For example for Windows, Defender and Certificate Updates, and optionally Defender Cloud Protection/Sample Submission (still undecisive about using the latter).

I checked the "Allow Windows Update" rule, however I am unsure about other applications/services. To mention a few:
- mpdefendercoreservice.exe
- lsass.exe
- svchost.exe
- System
- apphostregistrationverifier.exe
- taskhostw.exe
- nissrv.exe
- SppExtComObj.exe

Does anyone know which of these (or other important apps) should be allowed to connect to the internet for security purposes?

 

[silversurfer]

Hi,

I use Simplewall to whitelist apps which are allowed to connect to the internet. Since Windows has quite some privacy-invasive behavior by-default, I would like to only allow apps which strictly need it for security purposes. For example for Windows, Defender and Certificate Updates, and optionally Defender Cloud Protection/Sample Submission (still undecisive about using the latter).

I checked the "Allow Windows Update" rule, however I am unsure about other applications/services. To mention a few:
- mpdefendercoreservice.exe
- lsass.exe
- svchost.exe
- System
- apphostregistrationverifier.exe
- taskhostw.exe
- nissrv.exe
- SppExtComObj.exe

Does anyone know which of these (or other important apps) should be allowed to connect to the internet for security purposes?

If your AV is Defender (MD/WD) then you should allow both:

• mpdefendercoreservice.exe that is probably related to Microsoft Defender, just check the file location C:/ProgramData/Microsoft/Windows Defender/
• nissrv.exe = "Microsoft Network Realtime Inspection Service" (Microsoft Defender Network Protection)

 

[JordanMason8]

If your AV is Defender (MD/WD) then you should allow both:

• mpdefendercoreservice.exe that is probably related to Microsoft Defender, just check the file location C:/ProgramData/Microsoft/Windows Defender/
• nissrv.exe = "Microsoft Network Realtime Inspection Service" (Microsoft Defender Network Protection)

Thx for your answer. Simplewall also shows the name and location. The question is for what purposes they need an internet connection?

MS Defender Updates still seem to work (at least it didnt't complain when triggered) without these two allowed to go through the firewall and cloud protection (MAPS) is off.