{"id":21197373,"url":"https://github.com/victorpreston/windows-defender-configuration","last_synced_at":"2025-07-10T05:31:33.198Z","repository":{"id":183284644,"uuid":"669879345","full_name":"victorpreston/Windows-Defender-Configuration","owner":"victorpreston","description":"I analyze and update a system's Windows Defender antivirus and firewall configurations. I will complete tasks such as updating threat definitions, running antivirus scans, and configuring inbound/outbound network traffic rules so that the system is best protected against known vulnerabilities.","archived":false,"fork":false,"pushed_at":"2023-09-01T16:44:46.000Z","size":1401,"stargazers_count":14,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-07-05T04:49:48.291Z","etag":null,"topics":["cybersecurity","patching","practicals","projects","windows"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/victorpreston.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-23T18:15:51.000Z","updated_at":"2024-10-25T03:20:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"84272b59-5e7d-4ac6-9ced-ed91593813b3","html_url":"https://github.com/victorpreston/Windows-Defender-Configuration","commit_stats":null,"previous_names":["victorpreston/windows-defender-configuration"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/victorpreston/Windows-Defender-Configuration","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorpreston%2FWindows-Defender-Configuration","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorpreston%2FWindows-Defender-Configuration/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorpreston%2FWindows-Defender-Configuration/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorpreston%2FWindows-Defender-Configuration/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/victorpreston","download_url":"https://codeload.github.com/victorpreston/Windows-Defender-Configuration/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorpreston%2FWindows-Defender-Configuration/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264535993,"owners_count":23624404,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","patching","practicals","projects","windows"],"created_at":"2024-11-20T19:44:08.526Z","updated_at":"2025-07-10T05:31:33.192Z","avatar_url":"https://github.com/victorpreston.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Windows Defender Configuration\n\nIn this project I analyze and update a system's Windows Defender antivirus and firewall configurations. I will complete tasks such as updating threat definitions, running antivirus scans, and configuring inbound/outbound network traffic rules so that the system is best protected against known vulnerabilities. \n\n## Table of Contents\n\n1. [Part 1: Windows Defender Antivirus](#part-1-windows-defender-antivirus)\n2. [Part 2: Windows Defender Firewall](#part-2-windows-defender-firewall)\n3. [-Summary](#summary)\n\n## Part 1: Windows Defender Antivirus\n\n### Identify any current threats \n\nFirst I will assess the current state of the system's Windows antivirus and its configurations. \n\nThese settings can be found by navigating through: \n\n1. Click the Windows `Start` button \n2. Select `Settings` \n3. Scroll down and select `Update \u0026 Security`\n4. Select `Virus and threat protection`\n\n![](Images/Pasted%20image%2020230722130926.png)\n\nThe virus and threat protection window provides four different features: \n\n1. Current threats \n2. Virus and threat protection settings\n3. Virus and threat protection updates\n4. Ransomware protection\n\nThe `Current threats` section shows that the system has not been scanned for a few years and will need a scan as soon as possible. \n\n### Update threat definitions\n\nBefore running any scans, it is important to ensure that the system's `threat definitions*` are up to date as these contain threat intelligence and rules on the latest vulnerabilities. Running a scan with outdated threat definitions could result in a threat going undetected. \n\nIn the `Virus \u0026 threat protection updates` feature, I run a check for updates to ensure that the system has the latest threat definitions. \n\n![](Images/Pasted%20image%2020230722132703.png)\n\n### Run antivirus scans\n\nBecause of the length of time since the last scan, this system will benefit from a full scan. Windows Security provides tools for quick and custom scans that I will perform before the full scan. \n\nFor this system I will run a: \n\n1. Quick scan \n2. Custom scan for only the downloads folder \n3. Full scan\n\nPerforming a scan will scan files based on the newly updated threat definitions, and after each scan I verify that no threats were found, quarantined, or allowed: \n\n![](Images/Pasted%20image%2020230722132949.png)\n\n## Part 2: Windows Defender Firewall\n\n### Identify and configure firewall networks \n\nTo view the systems current firewall configurations, I navigate to the `Firewall \u0026 network protection` section of `Windows Security`\n\nWhile there I verify that each of the firewall network protections are enabled: \n\n1. Domain\n2. Private\n3. Public\n\n![](Images/Pasted%20image%2020230722150418.png)\n\nEach one is enabled and currently does not have incoming connections blocked, as expected, and the only active network is a public network: \n\n![](Images/Pasted%20image%2020230722150526.png)\n\n### Analyze and update firewall rules\n\nUsing the `Allow an app through firewall` option in the `Firewall \u0026 network protection` settings, I analyze the currently allowed apps that can communicate through the firewall. \n\n![](Images/Pasted%20image%2020230722150832.png)\n\nIn this list I can see that Mozilla Firefox is currently only allowed to communicate on private networks: \n\n![](Images/Pasted%20image%2020230722150943.png)\n\nI enable this app and allow it to communicate on public networks as well. \n\n### Configure advanced security firewall rules\n\nNext I will navigate to the advanced security firewall rules where I can allow/deny inbound and outbound traffic. \n\n![](Images/Pasted%20image%2020230722151808.png)\n\nFor this project I want to: \n```\n- Allow Key Management Service on domain and private networks \n- Block Key Management Service on public networks\n- Block Windows Remote Management on public networks\n```\nBefore we enable Key Management Service I want to verify the above rules are in place by navigating to its `Advanced` properties. \n\nFirst I will edit the existing Key Management Service `allow` rule to allow only domain and private networks.\n\n![](Images/Pasted%20image%2020230722153113.png)\n\n![](Images/Pasted%20image%2020230722152423.png)\n\nThen I will create a similar `block` rule that will block the public networks. \n\n![](Images/Pasted%20image%2020230722152856.png)\n![](Images/Pasted%20image%2020230722153018.png)\n\nIn the main panel I can confirm these were properly created and enabled: \n\n![](Images/Pasted%20image%2020230722153507.png)\n\nFinally, I edit the existing Windows Remote Management public rule to instead block all communications: \n\n![](Images/Pasted%20image%2020230722153812.png)\n\n## Summary\n\nIn this project I analyzed and configured a system's existing Windows Defender Antivirus and Firewall settings. Based on the existing configurations I completed various tasks such as: \n\n* Update Windows Defender Antivirus threat definitions\n* Run quick, full, and custom antivirus scans\n* Review antivirus threat history including quarantined and allowed threats\n* Configure allow/block firewall rules using Windows Defender Firewall with and without advanced security\n\nNow that these configurations are up to date, the system is much better protected against the latest known vulnerabilities defined by Microsoft and from unwanted network traffic. \n\n\n-    `Victor Preston`\n-    `Author`\n-    2023\n-    Widnows Defender Configuration\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictorpreston%2Fwindows-defender-configuration","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvictorpreston%2Fwindows-defender-configuration","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictorpreston%2Fwindows-defender-configuration/lists"}