Windows Defender Is Becoming the Powerful Antivirus That Windows 10 Needs

what does custom settings have to do with the fact that if you want to properly configure WD, you need a 3rd party tool to do so?

 

doesn't crush me at all bud!!!
I'm using settings in win 10 pro
use what you like and ill use what I like
Reminds of an old Hall and Oates song
"Some things are better left unsaid"

 

You don't need a 3rd party program to configure WD. You can do it via PowerShell or GP depending on your version on Windows. All the 3rd party app does is make it easier, but whether you choose to do it manually or with the app the result is the same.

Now what I will say is that it is indeed more difficult than other programs out there, but Microsoft intended these settings for enterprise/IT pros, not home users, hence why they did it this way. Most home users could care less about making changes to their security program, most just install it and that's it. It's really only us geeks that fiddle with settings.

 

Is it normal to spew negativity constantly?

 

There are plenty of PowerShell cmdlets posted earlier in this thread which I have used to harden WD. You don't need a third-party tool but it does give you a nice GUI.

 

is it normal to have emotional attachment to a software?

 

Is it normal to try categorizing things as normal?

 

Normal is a relative term.

I harden WD through Power Shell and Group Policy.

Robert

 

nine9s
I don't know if this link adds anything to what you already have regarding settings for WDef.??
https://www.thewindowsclub.com/windows-defender-settings-windows-10

fosseway

 

This might be useful
https://youtu.be/uLlv_aZjHXc

 

Windows Defender Can Detect Accessibility Tool Backdoors

https://www.bleepingcomputer.com/ne...nder-can-detect-accessibility-tool-backdoors/

 

Note this doesn't address APPX debugger methods that it appears Microsoft has "brushed off": https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/

 

Defender Injector v1.1 has been released
https://www.sordum.org/10636/defender-injector-v1-1/

 

A new transparency report has just been made available.
The report - Examining the AV-TEST September-October 2018 results - can be downloaded here (PDF) :

Code:

https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD

 

On page 10 of the above pdf, I can't fathom how startup/shutdown test measures could be applied across the board. Microsoft acknowledges some performance impacts, particularly with a "standard" PC (what are the criteria there, anyone?). For me, performance impacts trump protection ability any day of the week because I can manage the latter if need be, with tiny software tools. But drag my shutdown past five or six seconds and I'm finding that a "critical" issue indeed. (Shutdown w/Defender on here is virtually instant). It's frequently a matter of how much your antivirus gets on your nerves, it seems.

 

Hi @plat1098.
The configurations of the standard PCs and the high-end PCs currently used by AV-Test for their tests are listed here :
https://www.av-test.org/en/about-th...dures/test-modules-under-windows-performance/

 

Are there any new important tweaks for WD?

 

I keep TCPView running as a kind of wallpaper on my system. This morning I noticed that WD had turned its "Cloud Based Protection" on from a normal off state on my system, resulting in a great deal of svchost connections on TCPView. Weird eh? I turned it off but will now have to watch WD for autonomous setting changes :‑,

 

svchost has absolutely nothing to do with Defender or its cloud based protection.
Connections to Microsoft's cloud are made by MsMpEng.exe

 

It does have a direct connection. It loads WinDefend service which will start MsMpEng.exe:

"C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MsMpEng.exe"

Thereafter, MsMpEng.exe runs as a stand alone process versus a svchost.exe instance but still as a child process of SCM.

The Win firewall on the other hand runs as svchost.exe instance:

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

 

When using TCPView, a svchost process making an outbound connection will have a PID associated with it. The PID is usually associated with a Windows service.

 

All Windows active processes are assigned a PID; i.e. process identifier. Open Win Task Manager and click on the Details tab.

Also TCPView hasn't been updated since 2011. As such, it doesn't fully reflect Win 10 process status in regards to svchost.exe. Using Process Monitor, you will observe multiple processes running a given svchost.exe instance; multiple runtimebroker.exe instances, SmartScreen, dllhost.exe, etc.. All these processes have a unique PID.

 

Well sure, this is exactly what I do with a PID from TCPView.

Yea.

Also, the service that is activated with WD cloud protection is Windows Defender Advanced Threat Protection Service (which is what started this conversation). When I saw the svchost processes (many of them) in TCPView I used the PID referenced to use Task Manager details to find the service. It took me a couple of minutes to figure out that WD had re-enabled cloud protection. I disabled it using the WD control interface and the svchost processes stopped. Cloud protection has remained stopped since, but like some other MS stuff, I now know to keep an eye on this one. I'm not being judgemental, some people like cloud services, some don't.