Whitelist / Exclusions

[kjellherzke]

Hi,
I wanted to ask whether or not the possibility to "completely" whitelist some applications (.exe) exists? With "completely" I do mean that no security measure is taken against the app.

That would actually be essential, as some applications are marked as unsafe and immediately terminated, although I do intend to run them nevertheless.

I know that this might be a potential risk, on the user side. But it would be really necessary for some people, like me, to be able to effectively use this great tool.

Thanks!

[HotCakeX]

Hi,
Sure you can do that, if you're talking about the WDACConfig module you can do it via supplemental policies. If you're talking about Harden Windows Security module, you can do it in Microsoft Defender's GUI by adding your program to the exclusion list.

You can't exclude programs that Smart App Control blocks, only way for that is turning Smart App Control off, but remmeber you will need to reset/reinstall Windows to be able to turn it back on.

You can also exclude programs from most (but not all) Attack Surface Reduction rules.

I can implement a feature where the GUI will ask for a file/folder path and then automatically add the executables to the exclusion lists, is that something you're interested in?

P.S I also have to run some untrusted programs from time to time but i either use Windows Sandbox or Hyper-V since they provide a great security boundary between guest/host OSes.

[kjellherzke]

Also, in regards of that, I have thought about another "feature":
Why not add like custom presets, selecting customly the hardening features to apply? So that, you may have a "Medium Defense" presets, which still would like allow executing any exeutable file.

This would be really needed, as you would just want to select a preset and run that. For instance, I personally still do not have the ideal setup, and therefore I am still limited by these hardening measures in some way. Like, I would want to have a preset, that is very secure, but still allows me to execute any executable files, (even without an exclusion list)...... (disabling wdac policies)

E.g.: I noticed that I can not even run WSL (receiving "permission denied" error) with all the hardening measures applied.
In other words, I would appreciate a preset without restricting me when executing executables.

But that would be a design question, whether or not the exclusion list is considered. Also, this is just a vague suggestion.

[HotCakeX]

@kjellherzke I like it, sounds good, I'm thinking about adding buttons or a dropdown list for the presets so when you select a preset, the subsequent categories/subcategories will be selected so you can just press the execute button after that.

The presets should implement the design you're talking about.

[kjellherzke]

@HotCakeX I am glad to hear that you like that suggestion and am looking forward to seeing it being implemented! Thanks.

[HotCakeX]

@kjellherzke Presets have been implemented
https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/Hardening-Module-v.0.5.9

[kjellherzke]

@HotCakeX Great! It looks very good to me - will have a closer look later though.

[kjellherzke]

@HotCakeX Tried it, it works like a charm and the ui looks nice too. Thanks - issue closed!

[HotCakeX]

Awesome! your other request for whitelisting/exclusion will be added in the next version too! Tracking it here #323