Scripting/Powershell/PowerShell-collection/Misc/Bootstrap-MicrosoftDefenderConfiguration/Readme.md

Bootstrap Microsoft Defender configuration

Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 protection and security

What it does

Several Microsoft Defender settings are configured.

EnableNetworkProtection

Network protection helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet

Set to: Enabled

EnableControlledFolderAccess

Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware

Set to: Enabled

SignatureScheduleDay

Specifies the day of the week on which to check for definition updates.

Set to: Everyday

SignatureScheduleTime

Specifies the time of day, as the number of minutes after midnight, to check for definition updates

Set to: 320

DisableArchiveScanning

Indicates whether to scan archive files for malicious and unwanted software

Set to: true

DisableAutoExclusions

Indicates whether to disable the Automatic Exclusions feature for the server

Set to: false

DisableBehaviorMonitoring

Indicates whether to enable behavior monitoring

Set to: true

Something I enable on a few systems only.

DisableBlockAtFirstSeen

Indicates whether to enable block at first seen

Set to: true

DisableCatchupFullScan

Indicates whether Windows Defender runs catch-up scans for scheduled full scans

Set to: true

DisableCatchupQuickScan

Indicates whether Windows Defender runs catch-up scans for scheduled quick scans

Set to: true

DisableEmailScanning

Indicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments

Set to: false

DisableIOAVProtection

Indicates whether Windows Defender scans all downloaded files and attachments (e.g. Downloads)

Set to: true

DisableIntrusionPreventionSystem

Indicates whether to configure network protection against exploitation of known vulnerabilities

Set to: false

DisablePrivacyMode

Indicates whether to disable privacy mode. Privacy mode prevents users, other than administrators, from displaying threat history

Set to: false

DisableRealtimeMonitoring

Indicates whether to use real-time protection

Set to: false

CheckForSignaturesBeforeRunningScan

Set to: 1

DisableRemovableDriveScanning

Indicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan

Set to: true

DisableRestorePoint

Indicates whether to disable scanning of restore points

Set to: true

DisableScanningMappedNetworkDrivesForFullScan

Indicates whether to scan mapped network drives

Set to: true

DisableScanningNetworkFiles

Indicates whether to scan for network files

Set to: false

DisableScriptScanning

Specifies whether to disable the scanning of scripts during malware scans

Set to: false

HighThreatDefaultAction

Specifies which automatic remediation action to take for a high level threat

Set to: Quarantine

LowThreatDefaultAction

Specifies which automatic remediation action to take for a low level threat

Set to: Block

ModerateThreatDefaultAction

Specifies which automatic remediation action to take for a moderate level threat

Set to: Quarantine

PUAProtection

Disable PUA Protection

Set to: Enabled

QuarantinePurgeItemsAfterDelay

Specifies the number of days to keep items in the Quarantine folder

Set to: 30

RandomizeScheduleTaskTimes

Indicates whether to select a random time for the scheduled start and scheduled update for definitions

Set to: true

RealTimeScanDirection

Specifies scanning configuration for incoming and outgoing files on NTFS volumes

Set to: 0

RemediationScheduleDay

Specifies the day of the week on which to perform a scheduled full scan in order to complete remediation

Set to: Everyday

RemediationScheduleTime

Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan

Set to: 120

ReportingAdditionalActionTimeOut

Specifies the number of minutes before a detection in the additional action state changes to the cleared state

Set to: 10080

ReportingCriticalFailureTimeOut

Specifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state

Set to: 10080

ReportingNonCriticalTimeOut

Specifies the number of minutes before a detection in the non-critically failed state changes to the cleared state

Set to: 11440

ScanAvgCPULoadFactor

Specifies the maximum percentage CPU usage for a scan

Set to: 50

ScanOnlyIfIdleEnabled

Indicates whether to start scheduled scans only when the computer is not in use

Set to: true

ScanParameters

Specifies the scan type to use during a scheduled scan

Set to: 1

ScanPurgeItemsAfterDelay

Specifies the number of days to keep items in the scan history folder

Set to: 15

ScanScheduleDay

Specifies the day of the week on which to perform a scheduled scan

Set to: Everyday

ScanScheduleQuickScanTime

Specifies the time of day, as the number of minutes after midnight, to perform a scheduled quick scan

Set to: 0

ScanScheduleTime

Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan

Set to: 120

SevereThreatDefaultAction

Specifies which automatic remediation action to take for a severe level threat

Set to: Quarantine

SignatureAuGracePeriod

Specifies a grace period, in minutes, for the definition

Set to: 0

SignatureDisableUpdateOnStartupWithoutEngine

Indicates whether to initiate definition updates even if no antimalware engine is present

Set to: false

SignatureFirstAuGracePeriod

Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates

Set to: 120

SignatureScheduleDay

Specifies the day of the week on which to check for definition updates

Set to: Everyday

SignatureScheduleTime

Specifies the time of day, as the number of minutes after midnight, to check for definition updates

Set to: 165

SignatureUpdateCatchupInterval

Specifies the number of days after which Windows Defender requires a catch-up definition update

Set to: 1

SignatureUpdateInterval

Specifies the interval, in hours, at which to check for definition updates

Set to: 12

SubmitSamplesConsent

Specifies how Windows Defender checks for user consent for certain samples

Set to: AlwaysPrompt

MAPSReporting

Membership in Microsoft Active Protection Service Enable

Set to: Advanced

ThrottleLimit

Specifies the maximum number of concurrent operations that can be established to run the cmdlet

Set to: 0

UILockdown

Indicates whether to disable UI lock down mode

Set to: false

UnknownThreatDefaultAction

Specifies which automatic remediation action to take for an unknown level threat

Set to: Block

SignatureFallbackOrder

Specifies the order in which to contact different definition update sources. Specify the types of update sources in the order in which you want Windows Defender to contact them, enclosed in braces and separated by the pipeline symbol

Set to: MicrosoftUpdateServer | MMPC

ControlledFolderAccessAllowedApplications

We exclude the following Files by default: $env:windir\System32\taskhostw.exe

Any exclusions previously configured stay intact!

ExclusionPath

The following Files/Folders are excluded from the scan:

windir\SoftwareDistribution\DataStore\Datastore.edb windir\SoftwareDistribution\DataStore\Logs\Edb*.jrs windir\SoftwareDistribution\DataStore\Logs\Edb.chk windir\SoftwareDistribution\DataStore\Logs\Tmp.edb windir\Security\Database\*.edb windir\Security\Database\*.sdb windir\Security\Database\*.log windir\Security\Database\*.chk windir\Security\Database\*.jrs windir\Security\Database\*.xml windir\Security\Database\*.csv windir\Security\Database\*.cmtx ProgramData\ntuser.pol windir\System32\GroupPolicy\Machine\Registry.pol windir\System32\GroupPolicy\Machine\Registry.tmp windir\System32\GroupPolicy\User\Registry.pol windir\System32\GroupPolicy\User\Registry.tmp

Any exclusions previously configured stay intact!

More Info: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni

ExclusionProcess

The following processes are excluded from the scan:

$env:windir\System32\svchost.exe $env:windir\System32\wuauclt.exe

Any exclusions previously configured stay intact!

More Info: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni

Process Mitigation and Exploit Protection

Microsoft provides a XML file (ProcessMitigation.xml) that provides a configuration best practice to mitigate the attack surface and provide Exploit Protection.

You can provide your own File, otherwise (if missing) we will download the latest version from Microsoft.

More Info: https://demo.wd.microsoft.com/Page/EP

WindowsDefenderSandbox

We tuen on Windows Defender Sandbox

AttackSurfaceReduction

Attack Surface Reduction (ASR) is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as:

• Executable files and scripts used in Office apps or web mail that attempt to download or run files
• Scripts that are obfuscated or otherwise suspicious
• Behaviors that apps undertake that are not usually initiated during normal day-to-day work

More Info: https://demo.wd.microsoft.com/Page/ASR

ReloadRegistry

We then reload the registry to ensure that the new configuration is activated

EnableFirewall

Enable the Windows Firewall for all Profiles - Set the default to block everything

We enable the Windows Firewall for the following Network-Profiles:

• Domain
• Public
• Private

We block all inbound connections by default and we log all block-events!

UpdateSignature

As a final touch: We update the Windows Defender signatures.

Why this?

I use this during the bootstrap process of Windows systems. Most of the settings here is also enforced by some of our Group Policies and we also have a lot of it configured via MDM CSPs (InTune).

This script is only a quick hack to harden (and secure) any new system, even if it is not managed afterwords.

Content

There are two files:

Bootstrap-MicrosoftDefenderConfiguration.ps1

The PowerShell Script itself

Bootstrap-MicrosoftDefenderConfiguration.csv

A CSV File that contains the configuration of the attack surface reduction rules.

Configuration

Please review the Bootstrap-MicrosoftDefenderConfiguration.csv where you configure the attack surface reduction rules. Please also review the Bootstrap-MicrosoftDefenderConfiguration.ps1 file. There is no configuration file, at least not yet!

Further Information

https://docs.microsoft.com/en-us/powershell/module/defender/index?view=win10-ps

https://github.com/jhochwald/PowerShell-collection/blob/master/Misc/Optimize-MicrosoftDefenderExclusions.ps1

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection

https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction

https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus

https://demo.wd.microsoft.com/?ocid=cx-wddocs-testground

License

BSD 3-Clause License

Copyright (c) 2020, Joerg Hochwald All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.