Windows Hardening Tools

[n8chavez]

I'm just curious which Windows Security hardening tool you prefer. It really is looking like a third party is not needed with WS + hardening. Which tool do you use?

 

[Bot]

As a bot, I don't use tools. However, many users prefer Microsoft's built-in Windows Security tool along with the Security Compliance Toolkit for hardening. Third-party tools like CIS Benchmarks are also popular. Always choose based on your specific needs and environment.

 

[M4RT1NE2]

When I use Microsoft Defender - and I have been using it a lot lately - it is always with ConfigureDefender.

 

[WhiteMouse]

Others - Microsoft security baselines

 

[n8chavez]

When I use Microsoft Defender - and I have been using it a lot lately - it is always with ConfigureDefender.

How do you set ASR exclusions? From what I understand, CD is not interactive and there are no popups asking for permissions?

 

[Ulryk von Pizdeshturhau]

DefenderUIPro , great and easy to use app.

 

[Freki123]

If I plan to run only Windows Security + a hardening tool I would chose Hard Configurator or WHHlight. With Hard Configurator you have ConfigureDefender, Firewall Hardening and lot's of other option to play with. I really like the forced smartscreen and SRP options

@n8chavez Maybe add WHHlight, HC and DefenderUi to the vote otherwise it could result in lots of "other" votes.

 

[Gandalf_The_Grey]

I am using DefenderUI (it is like ConfigureDefender but with some extra's)

Enable / disable real-time protection
Enable / disable cloud-delivered protection
Enable / disable Windows Firewall
Enable / disable controlled folder access
Auto reactivate real-time protection
Auto reactivate cloud-delivered protection
Auto reactivate Windows Firewall
Auto reactivate controlled folder access
Manage and add exclusions
Manage notification settings
Perform scans
View and edit protection history
Actively monitor if Defender is disabled, and reactivate if it is
Tray icon to quickly disable / enable Defender, run scans, etc.
Various links to Microsoft Defender
Utility links to Protection History, Windows Security, Windows Update and Control Panel

DefenderUI

www.defenderui.com

And WindowsHybridHardening Light

Windows Hybrid Hardening Light (WHHLight) is a simplified configurator of (Windows built-in) application control features. It works on Windows 10 and 11 to support antivirus and prevent malware. WHHLight is a hybrid of Windows built-in security layers: SmartScreen, Software Restriction Policies (SRP), and Windows Defender Application Control (WDAC). After the initial configuration, WHHLight can be closed, and all protection comes from the Windows built-in features. SmartScreen, SRP, and WDAC work well with any antivirus - Microsoft Defender is not required.

Hard_Configurator/WindowsHybridHardening at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

 

[Practical Response]

If I'm running windows and want to harden it, I prefer built in tools such as gpedit found in the pro version.

 

[LennyFox]

Agree with @Gandalf_The_Grey

 

[wat0114]

I use WHHL along with ConfigureDefender and Firewall Hardening. I don't use Windows much these days, but that's what I use the few times I'm on Windows.

 

[simmerskool]

Others - Microsoft security baselines

where do you find MS security baselines? MS used to have an app you could run to test your security (geeez I forget was what it was called) but I haven't seen it for a few years...

 

[simmerskool]

with MS Defender usually DefenderUI with CyberLock on the side. In the alternative, WHHL. I have several VM with various combos of AV with & without hardening tools...

 

[Victor M]

Hi @simmerskool , here's where you download the MS Security Baseline: Download Security Compliance Toolkit and Baselines from Official Microsoft Download Center

Note: You have to download both LGPO and the correct Windows version, latest is Win 11 23H2. Read the ps1 file, the comments inside tells you where to place the LGPO and what parameters to use to run the script. If you don't include any parameters, it will fail.

 

[n8chavez]

If I plan to run only Windows Security + a hardening tool I would chose Hard Configurator or WHHlight. With Hard Configurator you have ConfigureDefender, Firewall Hardening and lot's of other option to play with. I really like the forced smartscreen and SRP options

@n8chavez Maybe add WHHlight, HC and DefenderUi to the vote otherwise it could result in lots of "other" votes.

I would if I could, but I don't seem to be able to edit the poll.

 

[jerzy601]

I use WD+Hard_Cofigurator+ Configurator Defender and nothing more, it is the best security for me and I am very pleased with it.

 

[Moonhorse]

Its pretty much microsoft defender + configuredefender on max for me if i use any hardening tools.

 

[n8chavez]

I use WD+Hard_Cofigurator+ Configurator Defender and nothing more, it is the best security for me and I am very pleased with it.

I was thinking of that too. But I do a lot of automation via scripting, and the ASR rules require a lot of exclusions. As far as I know Hard_Cofigurator+ Configurator Defender offers no exclusionary popups. Is that right? I'm trying DefenderUI Pro just for that reason.

 

[n8chavez]

Genuinely asking, how would you add ASR exclusions or even exclusions in general without DefenderUI Pro? Is there something else I could pai with ConfigureDefender to do that?

 

[jerzy601]

I don't use Defender UI Pro.
I use Hard_Defender with Configurator Defender which is in this application, I set CD to High and do nothing else with it.