Thank you for the great guide!

[ghost]

Just wanted to thank you for your great guide, it has invaluable info, very good for security conscious people but also easy to follow for non-tech-savvy people. I created a Powershell script for myself based off your guide and suggestions that does this all automatically and I run it every time I clean install Windows from scratch. also saves me some time using the GUI and togging buttons etc.

thank you also for not suggesting disabling Windows problem reporting and telemetry. saw a bunch of other hardening guides suggested doing that, due to paranoia, lack of necessary knowledge and/or intentional sabotage even.
Problem reporting, telemetry and Microsoft Active Protection Service (MAPS), they all help keep everyone safe and reduce the time for action.

when someone somewhere in the world experiences a problem with an update, a program, a Windows component, or gets a malware, tries to run an unknown file or program etc. etc., then these info are used by Microsoft to fix the problem, analyze the unknown file that could be malware, share the analysis data with Windows Defender engine to protect everyone, release patches using Windows update to fix Windows problem. the possibilities are endless.

so I'm just glad you made this guide and I found it. hope you keep it up to date,
Cheers!

[beerisgood]

Glad you like it and thanks for the feedback! 🍺

hope you keep it up to date

That may be a problem as I moved away from Windows but I will try. Most things will not change for a while or even long time so everything is still up2date 👍

[beerisgood]

Yes. And ARM is the more secure platform ;)
That's why phones are by design more secure than desktop.

Anyway let's focus on original thread 🍻

[beerisgood]

SRP and AppLocker are old. you should use WDAC (Windows Defender Application Control)

Microsoft has broken all three with their new Smart App Control (SAC) in 22H2:
https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/page-192#post-1006240

[ghost]

SRP and AppLocker are old. you should use WDAC (Windows Defender Application Control)

Microsoft has broken all three with their new Smart App Control (SAC) in 22H2: https://malwaretips.com/threads/hard_configurator-windows-hardening-configurator.66416/page-192#post-1006240

Nothing is broken.
SRP is irrelevant for client OS.

Smart App Control works fine, both in 22H2 and insider dev builds that I use. I almost try them daily at this point as I'm experimenting with signed WDAC policies.

WDAC also works fine. I'm using it right now on my main system.
just because someone in a random forum says something is broken doesn't mean it is. lol

I don't use any 3rd party tools that claims to make Windows secure, I've hardened my Windows 11 myself with native Powershell scripts I've written myself.

also, WDAC isn't for everyone to setup, you need to have sufficient knowledge about how it works first. lots of articles on the web about WDAC is old. WDAC is relatively new and it's constantly improving and changing, so do the methods required to configure and deploy it.

I can share my hardening script on Github if you want.

[beerisgood]

Okay. Strange that Andy (the dev from Hard_Configurator) doesn't wrote anything then in that thread.

You can of course share your WDAC setup and I will add your post or Git in my guide if you want. Personally I doesn't need it.

[ghost]

Okay. Strange that Andy (the dev from Hard_Configurator) doesn't wrote anything then in that thread.

You can of course share your WDAC setup and I will add your post or Git in my guide if you want. Personally I doesn't need it.

My WDAC setup is basically Singed&Reputable template from Microsoft that uses ISG (Intelligent security graph) as it takes care of most of the legitimate apps I wanna run, made it using WDAC Wizard, then I manually whitelist some programs that it otherwise blocks, such as portable telegram, 7-zip, Cheat Engine etc. things like that, with Powershell, it can be partially done with WDAC Wizard too but there are features that can only be used with Cmdlets and not included in WDAC Wizard's GUI.

I use these rules in the policy XML file:

<Rules>  
    <Rule>  
      <Option>Enabled:UMCI</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Inherit Default Policy</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Update Policy No Reboot</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Intelligent Security Graph Authorization</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Developer Mode Dynamic Code Trust</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Revoked Expired As Unsigned</Option>  
    </Rule>  
    <Rule>  
      <Option>Required:Enforce Store Applications</Option> 
    </Rule>  
    <Rule>
      <Option>Required:WHQL</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Dynamic Code Security</Option>  
    </Rule>  
    <Rule>  
      <Option>Disabled:Runtime FilePath Rule Protection</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Invalidate EAs on Reboot</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Allow Supplemental Policies</Option>  
    </Rule>  
    <Rule>  
      <Option>Enabled:Unsigned System Integrity Policy</Option>  
    </Rule>  
  </Rules>  

good thing is that if a program gets blocked, I can run it temporarily in Windows Sandbox or just create a supplementary policy to whitelist it, copy and paste it to the active policies directory and then use refreshpolicy.exe to reload WDAC policy in Windows without reboot.
pretty easy.

knowing these steps is more important. Microsoft docs has up to date guide about all of these but I also make notes for myself.

Smart App Control is just like WDAC, it uses ISG too, you can see what policies it uses in:
"C:\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml"

but you can't make exceptions for anything. so I tend to leave it at evaluation mode and use my own WDAC for now.

Things change a lot and fast in Windows, so programs that target certain components of Windows, like the program that person made to harden Windows, tend to cause problems, even if the problems aren't immediately noticed, they cause underlying issues that pop up later on.

it's better to stay away from such programs and use up to date info. like for example if modifying a registry was considered a hardening action a year ago, check newest Windows build, check insider builds from release preview and beta, see if the registry value is still the same or has it changed in a way that no longer needs modification.

another example, a bunch of hardening scripts/tools/software use WMIC but it's obsolete and Microsoft says to use other things. it's even blocked by WDAC policy.