Windows Defender Is Becoming the Powerful Antivirus That Windows 10 Needs

I havens used an AV in a long time but probably what happened was that as Avira PC Cleaner scanned the PC, Windows defender real time started doing it as well. So, it was like if you had 2 antiviruses scanning at the same time. When I used antiviruses and scanned with an OD scanner, to avoid what you describe, I turned off the real time protection of whatever AV I was using at the time on real time.

Bo

 

Has anyone tested the creators update or next insiders build, with all necessary registry tweaks enabled? Curious how it performs against zero days now. Not set up well to do this myself currently.

 

I would exclude Avira in Defender, and Defender in Avira.
Not familiar with Avira Cleaner, so this is just theory based on other such pairs I've used.

 

Registry tweaks?

 

Turning off Real-time protection would not be a wise thing to do, if Internet is on.

Exactly!

 

Avira PC Cleaner is just on demand scanner - no exclusions are possible. Personally, I would just disable WD temporarily, while scanning system.

 

But one can exclude Avira PC Cleaner directory in WD right?

Disabling real-time protection can work if you leave the PC during the scan, but if you are browsing the internet, then it would not be a wise thing to do !

 

Yes, off course, if one is concerned about getting infected during scan, excluding directory could also solve the problem. I don't use WD so I can't test it.

 

Anyone using WD for on-demand scans? I found this feature interesting. It then keeps updating automatically without keeping the real-time scanning on.

 

Might not be wise but it is what it is.

Bo

 

Oh, sweet joy. Windows 10 Fall Creators Update are getting closer and it is smoking hot.
As release are getting closer, Microsoft are of course getting all the documentation ready.

Some of the huge improvements are Windows Defender Exploit Guard : https://docs.microsoft.com/en-us/wi...efender-exploit-guard?ocid=cx-twidsw-docswdeg

Windows Defender Exploit Guard are four features : Exploit Protection, Attack Surface Reduction rules, Network Protection and Controlled Folder Access.

Exploit Protection :

Only requirement to use Exploit Protection, are that you are on Windows 10 Fall Creators Update.

It's configurable in Windows Defender Security Center, through Group Policy and PowerShell.

In case a mitigation are triggered, you will be alerted in Action Center and there will be a log entry in Windows Event Viewer.
Additional, if you are running Windows Defender ATP, then all events will show up there for centralized alert investigation.

More here, for an in-depth look at all the mitigations :
https://docs.microsoft.com/en-us/wi...xploit-guard/exploit-protection-exploit-guard
And more here : https://docs.microsoft.com/en-us/wi...er-exploit-guard/customize-exploit-protection

Attack Surface Reduction rules :

Requirements : Windows 10 Fall Creators Update and Windows Defender Antivirus fully active including cloud protection.

It's configurable through Group Policy, PowerShell and Mobile Device Management.

In case a rule are triggered, you will be alerted in Action Center and there will be a log entry in Windows Event Viewer.
Additional, if you are running Windows Defender ATP, then all events will show up there for centralized alert investigation.

More here for an in-depth look : https://docs.microsoft.com/en-us/wi...-guard/attack-surface-reduction-exploit-guard

Network Protection :

Requirements : Windows 10 Fall Creators Update and Windows Defender Antivirus fully enabled including cloud protection.

It's configurable through Group Policy, PowerShell and Mobile Device Management.

In case a connection are blocked, you will be alerted in Action Center and there will be a log entry in Windows Event Viewer.
Additional, if you are running Windows Defender ATP, then all events will show up there for centralized alert investigation.

Much more here : https://docs.microsoft.com/en-us/wi...xploit-guard/network-protection-exploit-guard

Controlled Folder Access :

Requirements : Windows 10 Fall Creators Update and Windows Defender Antivirus fully active including cloud protection.

It's configurable in Windows Defender Security Center and through Group Policy, PowerShell and Mobile Device Management.

In case a unknown or suspicious executable attempts to access a protected folder, you will be alerted in Action Center and there will be a log entry in Windows Event Viewer.
Additional, if you are running Windows Defender ATP, then all events will show up there for centralized alert investigation.

More here for an in-depth look : https://docs.microsoft.com/en-us/wi...xploit-guard/controlled-folders-exploit-guard

Huge boost for all the native security in Windows 10 Fall Creators Update.
This is a extremely powerful update. (and there's more )

 

Yes, it is

 

Good news indeed

 

@Martin_C Excellent stuff. Thank you for sharing all of that great details!

 

MS is serious about network protection. If you disable Windows Defender Firewall, you will get BSOD: "Critical Service Failed", within 5-10 mins.

 

With the updated documentation linked to by Martin_C, I decided to dig further into my latest Insider virtual machine. It appears that MS has the ProcessMitigations (https://www.powershellgallery.com/packages/ProcessMitigations) PowerShell module built into the code Windows installation now. Previously, you had to use some commands in PS to download/install the module from a separate repo. Now it's built-in. Also, the latest module available in the repo (and on that link) is 1.0.7 which does not contain all of the mitigation goodies from EMET. The ProcessMitigations PS module built into Fall Creators Update is 1.0.11 and contains all of the latest mitigations from EMET. The location in the file system is: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ProcessMitigations. However, for whatever reason, the typical ProcessMitigations.dll module is not there. So the module must be elsewhere or quite likely built into another binary elsewhere. Either way, it is fantastic to see Microsoft progress with protection from all angles and all aspects.

 

Critical improvements to Windows Defender and it's reassuring, finally. People keep Defender enabled for reasons other than it's "free." I'll be interested in upcoming comparatives. My main bane has been the update delivery method which has left too many people's machines, their property "smoking hot." I believe Microsoft has made modifications to that end as well. We'll see.

 

You can disable the firewall itself, you get problems if you disable the service (MpsSvc)

 

Disabling the service improves the network speed. The problem only started since 12673, maybe it will be fixed, but I doubt it, if the security implementations are considered critical.

 

@Martin_C

Thanks for the info.

 

@Martin_C thanks for the information. Interesting development indeed.

 

You are welcome, all.
Those who haven't tried the new Fall Creators Update branch yet, really have something to look forward to.
So many improvements and it's running super smooth.

 

Threat Mitigations in Windows 10
https://blogs.technet.microsoft.com/iftekhar/2017/08/28/threat-mitigation-in-windows-10/

 

I still can't understand if all these improvements also apply to Windows 10 Home edition... from the Microsoft website (https://docs.microsoft.com/en-us/wi...p/windows-defender-advanced-threat-protection) it seems that it only applies to the Pro, Enterprise and Education versions...

 

And whether anti-exploit programs like HMPA or MB3 AE will be compatible, if not unnecessary.

I would imagine Exploit Guard or 3rd party softs would have to 'step aside' for each other, if the latter are installed?