Some differences between ConfigureDefender and Harden-System-Security

[matru]

I assumed that there is no better place to open the discussion, but here, and maybe I can link it back to another thread on the other tool's page.

Recently, I've stumbled upon HotCakeX's tools:

https://github.com/HotCakeX/Harden-Windows-Security/wiki/Microsoft-Defender

available on MS Store:

https://apps.microsoft.com/detail/9p7ggfl7dx57?mode=direct&hl=en-US

And I wondered if you would consider the included features in the tool's Microsoft Defender section, which are numerous, are worth using over ConfigureDefender's options? And while ultimately I can only be the judge of it, there are some the options in one or the other tool I am not completely familiar with and would like to ask @AndyFul if there's a feature in one that you believe is worth choosing one over the other's. Of course if someone has any experience switching from one to the other tool, would be greatly appreciated to contribute in the discussion.

@HotCakeX has another great tool though, which for sure could at least be used in conjunction with CD, https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager.

[AndyFul]

ConfigureDefender is focused on the MD real-time settings. I do not plan to add other settings soon.

AppControl-Manager is an advanced tool for configuring App Control for Business (formerly WDAC). A simplified tool for home users can be found here:
https://github.com/AndyFul/Hard_Configurator/tree/master/WindowsHybridHardening
It also includes ConfigureDefender.

Edit.
The outdated info about PowerShell dependency was corrected.

[HotCakeX]

There is no PowerShell dependency or edition restriction.

• https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager
• https://x.com/CyberCakeX/status/1920898237533220945

[AndyFul]

HotCakeX,

Do you create WDAC policies by using Windows APIs?
Anyway, I could not create a WDAC policy on Windows Home when using the version from the Microsoft Store:

I corrected my previous post according to the PowerShell dependence.

[AndyFul]

Well, I did not test the new updated version from GitHub. Congratulations. :)

[HotCakeX]

@AndyFul Thanks ^^

Yes, the missing file is part of the OS and I don't think I'm legally allowed to bundle it in my app. It exits in non-Home editions in here: C:\Windows\schemas\CodeIntegrity\cipolicy.xsd, you could copy it to your home edition and use it.

I could take a look at the whole process in my app again and see if i can do something that won't require that file.

P.S both apps support Polish language!

[AndyFul]

HotCakeX

I am really impressed by your project and documentation. Excellent work. 🥇

[matru]

ConfigureDefender is focused on the MD real-time settings. I do not plan to add other settings soon.

AppControl-Manager is an advanced tool for configuring App Control for Business (formerly WDAC). A simplified tool for home users can be found here: https://github.com/AndyFul/Hard_Configurator/tree/master/WindowsHybridHardening It also includes ConfigureDefender.

@AndyFul Yes I know that WHH is more akin to AppControl-Manager, but my main question was about the Harden-Windows-Security project, which is a more direct alternative that features we can compare to ConfigureDefender:

And I wondered if you would consider the included features in the tool's Microsoft Defender section, which are numerous, are worth using over ConfigureDefender's options?

Here's the documentation for the project. And here's the app, available on msstore.

[AndyFul]

I did not analyse this project in depth, but some features can probably be implemented. We will see.
However, home users do not need more than what is already included in ConfigureDefender.

[matru]

@AndyFul Thanks. I am not a Home user, are Windows Pro users exposed to many more Windows Defender Features that were intentionally not included in Configure Defender for broader compatibility with Windows users?

[AndyFul]

Windows Defender features (also those not included in ConfigureDefender) can be tweaked by using PowerShell.
On Windows Pro, you can also use Local Security Policy (secpol.msc) or Edit Group Policy (gpedit.msc).
But, those methods are unrelated to ConfigureDefender.