14 KiB
Bootstrap Microsoft Defender configuration
Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 protection and security
What it does
Several Microsoft Defender settings are configured.
EnableNetworkProtection
Network protection helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet
Set to: Enabled
EnableControlledFolderAccess
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware
Set to: Enabled
SignatureScheduleDay
Specifies the day of the week on which to check for definition updates.
Set to: Everyday
SignatureScheduleTime
Specifies the time of day, as the number of minutes after midnight, to check for definition updates
Set to: 320
DisableArchiveScanning
Indicates whether to scan archive files for malicious and unwanted software
Set to: true
DisableAutoExclusions
Indicates whether to disable the Automatic Exclusions feature for the server
Set to: false
DisableBehaviorMonitoring
Indicates whether to enable behavior monitoring
Set to: true
Something I enable on a few systems only.
DisableBlockAtFirstSeen
Indicates whether to enable block at first seen
Set to: true
DisableCatchupFullScan
Indicates whether Windows Defender runs catch-up scans for scheduled full scans
Set to: true
DisableCatchupQuickScan
Indicates whether Windows Defender runs catch-up scans for scheduled quick scans
Set to: true
DisableEmailScanning
Indicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments
Set to: false
DisableIOAVProtection
Indicates whether Windows Defender scans all downloaded files and attachments (e.g. Downloads)
Set to: true
DisableIntrusionPreventionSystem
Indicates whether to configure network protection against exploitation of known vulnerabilities
Set to: false
DisablePrivacyMode
Indicates whether to disable privacy mode. Privacy mode prevents users, other than administrators, from displaying threat history
Set to: false
DisableRealtimeMonitoring
Indicates whether to use real-time protection
Set to: false
CheckForSignaturesBeforeRunningScan
Set to: 1
DisableRemovableDriveScanning
Indicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan
Set to: true
DisableRestorePoint
Indicates whether to disable scanning of restore points
Set to: true
DisableScanningMappedNetworkDrivesForFullScan
Indicates whether to scan mapped network drives
Set to: true
DisableScanningNetworkFiles
Indicates whether to scan for network files
Set to: false
DisableScriptScanning
Specifies whether to disable the scanning of scripts during malware scans
Set to: false
HighThreatDefaultAction
Specifies which automatic remediation action to take for a high level threat
Set to: Quarantine
LowThreatDefaultAction
Specifies which automatic remediation action to take for a low level threat
Set to: Block
ModerateThreatDefaultAction
Specifies which automatic remediation action to take for a moderate level threat
Set to: Quarantine
PUAProtection
Disable PUA Protection
Set to: Enabled
QuarantinePurgeItemsAfterDelay
Specifies the number of days to keep items in the Quarantine folder
Set to: 30
RandomizeScheduleTaskTimes
Indicates whether to select a random time for the scheduled start and scheduled update for definitions
Set to: true
RealTimeScanDirection
Specifies scanning configuration for incoming and outgoing files on NTFS volumes
Set to: 0
RemediationScheduleDay
Specifies the day of the week on which to perform a scheduled full scan in order to complete remediation
Set to: Everyday
RemediationScheduleTime
Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan
Set to: 120
ReportingAdditionalActionTimeOut
Specifies the number of minutes before a detection in the additional action state changes to the cleared state
Set to: 10080
ReportingCriticalFailureTimeOut
Specifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state
Set to: 10080
ReportingNonCriticalTimeOut
Specifies the number of minutes before a detection in the non-critically failed state changes to the cleared state
Set to: 11440
ScanAvgCPULoadFactor
Specifies the maximum percentage CPU usage for a scan
Set to: 50
ScanOnlyIfIdleEnabled
Indicates whether to start scheduled scans only when the computer is not in use
Set to: true
ScanParameters
Specifies the scan type to use during a scheduled scan
Set to: 1
ScanPurgeItemsAfterDelay
Specifies the number of days to keep items in the scan history folder
Set to: 15
ScanScheduleDay
Specifies the day of the week on which to perform a scheduled scan
Set to: Everyday
ScanScheduleQuickScanTime
Specifies the time of day, as the number of minutes after midnight, to perform a scheduled quick scan
Set to: 0
ScanScheduleTime
Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan
Set to: 120
SevereThreatDefaultAction
Specifies which automatic remediation action to take for a severe level threat
Set to: Quarantine
SignatureAuGracePeriod
Specifies a grace period, in minutes, for the definition
Set to: 0
SignatureDisableUpdateOnStartupWithoutEngine
Indicates whether to initiate definition updates even if no antimalware engine is present
Set to: false
SignatureFirstAuGracePeriod
Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates
Set to: 120
SignatureScheduleDay
Specifies the day of the week on which to check for definition updates
Set to: Everyday
SignatureScheduleTime
Specifies the time of day, as the number of minutes after midnight, to check for definition updates
Set to: 165
SignatureUpdateCatchupInterval
Specifies the number of days after which Windows Defender requires a catch-up definition update
Set to: 1
SignatureUpdateInterval
Specifies the interval, in hours, at which to check for definition updates
Set to: 12
SubmitSamplesConsent
Specifies how Windows Defender checks for user consent for certain samples
Set to: AlwaysPrompt
MAPSReporting
Membership in Microsoft Active Protection Service Enable
Set to: Advanced
ThrottleLimit
Specifies the maximum number of concurrent operations that can be established to run the cmdlet
Set to: 0
UILockdown
Indicates whether to disable UI lock down mode
Set to: false
UnknownThreatDefaultAction
Specifies which automatic remediation action to take for an unknown level threat
Set to: Block
SignatureFallbackOrder
Specifies the order in which to contact different definition update sources. Specify the types of update sources in the order in which you want Windows Defender to contact them, enclosed in braces and separated by the pipeline symbol
Set to: MicrosoftUpdateServer | MMPC
ControlledFolderAccessAllowedApplications
We exclude the following Files by default: $env:windir\System32\taskhostw.exe
Any exclusions previously configured stay intact!
ExclusionPath
The following Files/Folders are excluded from the scan:
windir\SoftwareDistribution\DataStore\Datastore.edb
windir\SoftwareDistribution\DataStore\Logs\Edb*.jrs
windir\SoftwareDistribution\DataStore\Logs\Edb.chk
windir\SoftwareDistribution\DataStore\Logs\Tmp.edb
windir\Security\Database\*.edb
windir\Security\Database\*.sdb
windir\Security\Database\*.log
windir\Security\Database\*.chk
windir\Security\Database\*.jrs
windir\Security\Database\*.xml
windir\Security\Database\*.csv
windir\Security\Database\*.cmtx
ProgramData\ntuser.pol
windir\System32\GroupPolicy\Machine\Registry.pol
windir\System32\GroupPolicy\Machine\Registry.tmp
windir\System32\GroupPolicy\User\Registry.pol
windir\System32\GroupPolicy\User\Registry.tmp
Any exclusions previously configured stay intact!
ExclusionProcess
The following processes are excluded from the scan:
$env:windir\System32\svchost.exe
$env:windir\System32\wuauclt.exe
Any exclusions previously configured stay intact!
Process Mitigation and Exploit Protection
Microsoft provides a XML file (ProcessMitigation.xml) that provides a configuration best practice to mitigate the attack surface and provide Exploit Protection.
You can provide your own File, otherwise (if missing) we will download the latest version from Microsoft.
More Info: https://demo.wd.microsoft.com/Page/EP
WindowsDefenderSandbox
We tuen on Windows Defender Sandbox
AttackSurfaceReduction
Attack Surface Reduction (ASR) is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as:
- Executable files and scripts used in Office apps or web mail that attempt to download or run files
- Scripts that are obfuscated or otherwise suspicious
- Behaviors that apps undertake that are not usually initiated during normal day-to-day work
More Info: https://demo.wd.microsoft.com/Page/ASR
ReloadRegistry
We then reload the registry to ensure that the new configuration is activated
EnableFirewall
Enable the Windows Firewall for all Profiles - Set the default to block everything
We enable the Windows Firewall for the following Network-Profiles:
- Domain
- Public
- Private
We block all inbound connections by default and we log all block-events!
UpdateSignature
As a final touch: We update the Windows Defender signatures.
Why this?
I use this during the bootstrap process of Windows systems. Most of the settings here is also enforced by some of our Group Policies and we also have a lot of it configured via MDM CSPs (InTune).
This script is only a quick hack to harden (and secure) any new system, even if it is not managed afterwords.
Content
There are two files:
Bootstrap-MicrosoftDefenderConfiguration.ps1
The PowerShell Script itself
Bootstrap-MicrosoftDefenderConfiguration.csv
A CSV File that contains the configuration of the attack surface reduction rules.
Configuration
Please review the Bootstrap-MicrosoftDefenderConfiguration.csv where you configure the attack surface reduction rules. Please also review the Bootstrap-MicrosoftDefenderConfiguration.ps1 file. There is no configuration file, at least not yet!
Further Information
https://docs.microsoft.com/en-us/powershell/module/defender/index?view=win10-ps
https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps
https://demo.wd.microsoft.com/?ocid=cx-wddocs-testground
License
BSD 3-Clause License
Copyright (c) 2020, Joerg Hochwald All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.