Difference between the GPEDIT options "Turn on behavior monitoring" and "Monitor file and program activity on your computer"? And do I need them both?

DesignHeaad9206 · Aug 18, 2024

Hi!

So, after the inputs received in my other thread about if I really need real time protection, I decided to activate it again.
In GPEDIT (where I had deactivated all, because otherwise Windows Security keeps reactivating the real time protection even if the anti-tampering option is disabled) I find two similar options, which I wrote in the title.
When I DuckDuckGo for the latter, I find results for the former.
The latter sounds also a bit like DEP although I guess it's not DEP.

Anyway, can you explain what's the difference between the two, and if I really need them both running?
Ah, btw, what's your take about having DEP set in "for all programs"?

thanks

garlin · Aug 18, 2024

Data Execution Protection (DEP) is one of several Windows tricks to defend against buffer overflow attacks. By carefully designating which memory pages are assigned to code vs. stack (dynamic memory), exploits can't take advantage of buffer overflows to overwrite a code page. The cost of running DEP all the time is negligible for a modern CPU.

Should you run it all the time? Yes, it helps prevent some basic security attacks.
Why does Windows allow me to disable it? On really old CPU's, it was known to cause stability issues.

Windows security is based on in-depth layers, because a single security feature isn't enough to protect you from all forms of attack.

DesignHeaad9206 · Aug 18, 2024

garlin said:
Data Execution Protection (DEP) is one of several Windows tricks to defend against buffer overflow attacks. By carefully designating which memory pages are assigned to code vs. stack (dynamic memory), exploits can't take advantage of buffer overflows to overwrite a code page. The cost of running DEP all the time is negligible for a modern CPU.

Should you run it all the time? Yes, it helps prevent some basic security attacks.
Why does Windows allow me to disable it? On really old CPU's, it was known to cause stability issues.

Windows security is based on in-depth layers, because a single security feature isn't enough to protect you from all forms of attack.

Well, disabling it completely is only possible with special tools and I didn't feel the need. The question was if leaving it in the default "only for windows files" or set it in "for all programs".

And what about those two Defender GPEDIT settings, any idea what the latter does?

glasskuter · Aug 18, 2024

DesignHeaad9206 said:
if I really need real time protection, I decided to activate it again.

You're the one who decided to strip your OS. Did you not keep record of what you did so you would now how to undo it?

Marcus Vinicus · Aug 18, 2024

glasskuter said:
You're the one who decided to strip your OS. Did you not keep record of what you did so you would now how to undo it?

That is a must. Also, is the OP keeping a regular full system backup using Macrium, AOMEI or similar while they're carrying out all this tinkering?

glasskuter · Aug 18, 2024

Marcus Vinicus said:
is the OP keeping a regular full system backup

That was strongly advised but this OP has not indicated in his other thread whether he took the advice or not.

DesignHeaad9206 · Aug 18, 2024

What are you two even talking about?
I've stripped nothing.
This is just an option that can be deactivated and reactivated at al times.
And I'm simply asking what are these two options for, so I can better decide if I want to keep them both active or only the behavior monitoring.
Easy.
All this sarcasm you can save it for when you need to digest things that need more acidity. Really not needed.

garlin · Aug 18, 2024

DesignHeaad9206 said:
Well, disabling it completely is only possible with special tools and I didn't feel the need. The question was if leaving it in the default "only for windows files" or set it in "for all programs".

And what about those two Defender GPEDIT settings, any idea what the latter does?

There are no "special tools", it's always been in the legacy Control Panel for System Properties or the newer W11 Settings control panel.
How to Enable or Disable Data Execution Prevention

The two Defender policies in a nutshell:
Behavior monitoring in Microsoft Defender Antivirus
Enable and configure Microsoft Defender Antivirus always-on protection

Sometimes these policies cause false positives, which is why you're allowed to disable them. All these settings (including DEP) can be enabled or disabled on the fly.

pseymour · Aug 18, 2024

"Monitor file and program activity" is the setting for on access protection. This is for the "automatic" anti-malware protection that kicks in whenever something is accessed, as opposed to on-demand action where you tell Defender to scan something specifically.

Behavior monitoring is, well, monitoring the behavior of processes and killing things that act suspicious. This is different from, say, the anti-malware engine having a set of known signatures and blocking files it knows are bad, based on history. Behavior monitoring acts on things based on what they do, whether they're known processes or not.

Behavior monitoring in Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Learn about Behavior monitoring in Microsoft Defender Antivirus and Defender for Endpoint.

learn.microsoft.com

DesignHeaad9206 · Aug 18, 2024

garlin said:
There are no "special tools", it's always been in the legacy Control Panel for System Properties or the newer W11 Settings control panel.
How to Enable or Disable Data Execution Prevention

Hmmm, but would that completely disable it also for windows files?
Or would that only disable it "for all programs" but leave it for windows files?
Considering that in the advanced system settings (that until now was the only place where I was aware that this could be changed) doesn't give the possibility to completely disable it, I took for granted that it can not be.
I even saw that there's a voice about it in the Exploit Protection of Defender, I saw it many times, but I always believed that it wouldn't completely disable it :)

garlin said:
The two Defender policies in a nutshell:
Behavior monitoring in Microsoft Defender Antivirus
Enable and configure Microsoft Defender Antivirus always-on protection

In the second link (which I knew, but thanks

) I don't find anything about "Monitor file and program activity on your computer".
It just says that the always-on protection is a holy trinity made of Real Time Protection, Behavior Monitoring, and Heuristic.
Now, apart for the fact that I never really understood what's the difference between Heuristic and Behavior Monitoring, as both are ways to detect bad stuff without using signatures, in this case I can only think that you imply that Heuristic is the same as "Monitor file and program activity on your computer", otherwise I don't get the connection that you're making

DesignHeaad9206 · Aug 18, 2024

pseymour said:
"Monitor file and program activity" is the setting for on access protection. This is for the "automatic" anti-malware protection that kicks in whenever something is accessed, as opposed to on-demand action where you tell Defender to scan something specifically.

But wouldn't that be the same as "real time protection"?
I mean, real time protection means that all what happens is monitored in real time "on access", or am I inventing stuff (which could be, because my knowledge is completely DIY)?

What confuses me is that there's an option for real time protection already.
There are 4 similar options, real time protection, heuristic, behavior monitoring, monitor file and program activity.
Ah, and DEP.
And I am unsure as to how they differ.
RTP and MFAPA seem completely the same to me.
And BM and H also seem the same.
DEP, I understand that it's a different thing but for example I don't understand if by disabling RTP and/or MFAPA also DEP would be disabled, because DEP implies that things are monitored in real time.
In the same way I wonder if by disabling RTP and/or MFAPA also BM and H would stop...
So, it's all a bit confusing.

glasskuter · Aug 18, 2024

DesignHeaad9206 said:
What are you two even talking about?
I've stripped nothing.

Is this not your thread.? So, I got obsessed with achieving the perfect clean install and it took me a week and many many attempts. Feel free to comment what can be improved.

strip=deloat, remove, alter, disable... anything that stops normal windows functions. You said yourself your were obsessed in your quest against against "MS from 'interfering' with your Windows." I mean no disrespect. Is that not what was discussed in your other thread?

All I'm saying is if you set out to make major changes, you should keep detailed notes on what you do so that, as in this case, you can undo it.

pseymour · Aug 18, 2024

DesignHeaad9206 said:
But wouldn't that be the same as "real time protection"?

No. You already said it yourself, but MSFT clarifies that "Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities."

DesignHeaad9206 · Aug 18, 2024

glasskuter said:
Is this not your thread.

Yeah but I meant that in THIS case I stripped nothing.
It's two completely unrelated things.
I do keep track of what I do.
But in this case I didn't need to understand these two processes in detail when I wanted to disable things, so I didn't bother looking for detailed info, I just disabled all what was implying some for or background activity.
Now that I decided that it's indeed not safe to be completely without real time, I am trying to understand what's the difference between these processes so that I can on one hand satisfy my need to know what's what, and on the other hand decide what I need and what I don't.

Your comment seemed a generic discrediting of my entire attitude towards Windows, which is your right to believe so, and I have no problem with you saying it (although it would be nice if you can do it without sarcasm, like if you're right and I am wrong, which is different from "I prefer this way"). But it didn't seem to contribute to what this thread is for.

DesignHeaad9206 · Aug 18, 2024

pseymour said:
No. You already said it yourself, but MSFT clarifies that "Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities."

Sorry, I don't get it.
There is the holy trinity, and there is MFAPA.
What's the relationship between them?

pseymour · Aug 18, 2024

"MFAPA" is not a thing. That's the friendly human-readable description for a setting. The actual registry entry created when you change that setting is "DisableOnAccessProtection."

glasskuter · Aug 18, 2024

Not related to the question in this thread either but in case you're interested. Just as an FYI, I believe you have windows update off. Defender AV depends on windows update to download a new definitions' update every day, sometimes more often for zero day fixes.