Introducing Exploit Mitigations page
The Exploit Mitigations page in the Harden System Security app is a focused operational workspace for Windows process mitigation policy. It brings registry-backed rules (IFEO / Image File Execution Options), live process state, system defaults, recommendations, and binary inspection into a single coherent dashboard so you can make changes with confidence and then immediately verify outcomes.
What This Page Covers
The Exploit Mitigations page is split into 5 functional views:
- Registry - per-process mitigation policies stored in the registry.
- Running Processes - live mitigation state of currently running processes.
- Recommended - curated recommended mitigation sets for specific programs. They align with the app's broader hardening guidance in the Microsoft Defender category.
- Binary Scan - binary hardening inspection for selected executable files and folders.
- System - system-wide exploit mitigation settings.
Registry View
The Registry view is for reading and managing per-process exploit mitigation entries under the Image File Execution Options policy area.
Main Capabilities
- Process the registry and load the current mitigation inventory.
- Search and sort the data.
- Export the loaded mitigation data to JSON.
- Import mitigation configuration from XML.
- Export mitigation configuration to XML.
- Open the exact registry location directly in Registry Editor.
- Add mitigations for new processes.
- Modify an existing process mitigation entry.
- Delete an existing registry process mitigation entry.
Use this section when you need an authoritative view of what the system will enforce for a given executable.
Mitigation Dialogs
- Edit: Double-clicking a registry row opens the mitigation editor directly. Use it to set Enabled, Disabled, or Not configured states, apply supported force overrides, and review a change summary before committing policy updates. When creating new entries, you can define the target explicitly or select an executable path for accuracy.
- Details: Use the details dialog when you want a clean, copyable snapshot of the exact option-level state, including forced-state visibility and a structured list of all options for that target.
Running Processes View
The Running Processes view shows live mitigation data for processes that are currently executing.
Main Capabilities
- Refresh the running-process inventory on demand.
- Enable Auto Refresh with a configurable interval.
- Search the loaded process list and sort it.
- Export the current running-process results to JSON.
- Open a full details dialog for the selected running process.
Use this view when you need to confirm the effective mitigation state of a live process without relying exclusively on static policy. It is also useful for spotting drift between what is configured and what is currently active.
Recommended View
The Recommended view groups curated mitigation recommendations by program and lets you work at both group level and individual mitigation level.
Main Capabilities
- Search recommended programs and mitigation groups.
- Apply all recommendations for a program.
- Verify compliance for a program.
- Remove the recommended mitigation set for a program.
- Run bulk actions across the currently visible recommendation groups.
- Verify results after apply/remove operations.
Use this view when you want a pragmatic baseline for a program (apply + verify), or when you want a controlled way to revert only the recommendation set without disturbing unrelated mitigations.
Binary Scan View
The Binary Scan view inspects selected executable files and folders and reports binary-level exploit-hardening indicators.
Main Capabilities
- Queue one or more executable files.
- Queue one or more folders.
- Scan the selected targets.
- Search and sort the results.
- Export the results to JSON.
Use this view as a pre-flight check (to understand what a binary supports) before applying mitigations to it.
System View
The System view exposes the system-wide mitigation configuration and supports filtering the option set.
Main Capabilities
- Load the system-wide mitigation state.
- Search and filter the system mitigation options.
- Modify the system-wide mitigation set through the mitigation editor.
Use this view when you want to establish system defaults that apply broadly, and then layer per-process exceptions in the Registry view where necessary.
Mitigation Editor
Press the Modify button to access the system mitigations editor.
- Search across supported mitigation names and descriptions.
- Configured / Not configured filtering.
- A parent-and-child dependency layout so dependent mitigations appear directly under their required parent mitigation.
- Automatic dependency handling:
- enabling a child mitigation automatically enables its required parent when needed
- disabling a required parent clears dependent child selections back to Not configured
- Force override support where the underlying policy allows it.
- A live change summary before applying.
This editor is intentionally dependency-aware so mitigation relationships are visible and handled deterministically (for example, enabling StrictCFG will satisfy its requirement on CFG, and disabling CFG will clear dependent child choices back to Not configured).
Refresh Behavior
After mitigation changes are applied, Harden System Security refreshes the relevant data views so you can review the updated states immediately.
Comparison Chart: Microsoft Defender vs Harden System Security
The table below compares the exploit mitigation experience offered by Microsoft Defender's Exploit Protection surface and Harden System Security. The Harden System Security app offers all of the Exploit Mitigation features available in the Microsoft Defender (Windows Security app) plus the following:
| Capability | Microsoft Defender | Harden System Security |
|---|---|---|
Display hidden exploit mitigations like the one for MsSense.exe
| ❌ | ✅ |
| Display all exploit mitigations no matter the total count | ❌ (Refuses to load the programs list if too big) | ✅ |
| Export the data to JSON | ❌ | ✅ |
| Search through the data and sort the data | ❌ | ✅ |
| Offer the full set of mitigations for the System context | ❌ (Only offers a small subset of the mitigations for the System) | ✅ |
| View changes without closing and reopening the app | ❌ | ✅ |
| View running processes' mitigations | ❌ | ✅ |
| Modify mitigations that have override/force flag | ❌ (they are grayed out) | ✅ |
Closing Notes
This page is designed to support an end-to-end mitigation workflow: discover what exists, make deliberate adjustments, and immediately validate the new state through both persisted policy and live process inspection.
Other Changes
-
The links in the Microsoft Edge category's page now point to the exact location for each policy in the policies page in Microsoft Learn website. PR contribution by @pingu-the-penguin: #1150
-
When trying to uninstall apps in the Manage Installed Apps page, if you select Harden System Security app itself, there will be a warning asking you for confirmation before continuing. Completes the following request: #1151
-
3 of the tiles on the Home page now include live charts: CPU temp, Storage temp and app RAM usage.
-
Updated dependencies to the latest versions.