Security Center

[Black Viper]

Discussion of the Security Center Service located in Windows Vista SP1.

Security Center
Service Information: http://www.blackviper.com/WinVista/Services/Security_Center.htm

[rocket]

Hello. I'm running Vista SP1 x64 with all updates except some recent security ones (because the only Window's security service I use is the firewall - no defender, parental controls, IE, or related. I also have Windows Update disabled). I'm trying to get the Security Center to quit warning me that these things are turned off, however, no matter what I do, that little red shield always shows up on start up. When I go to Control Panel > Security Center (or Control Panel > Security > Security Center, in the default view), it says the service is already off. There's no link in side pane that says "Change the way Security Center alerts me"... Any suggestions?

[Spawn]

Turn the service and the security center back on.  Reboot.  Now the option will be available for you to change how it alerts you.  Now tell it not to notify you, then turn the security system off and go and disable the service.

Spawn

[couttsj]

The Security Center service is just a nag screen. If the service is disabled (not just turned off), you should never see it.

J.A. Coutts

[rocket]

Thanks! That worked. Before I wasn't able to change the setting because I went right to disabling the service itself through services.msc.

@couttsj: the shield was showing up even with the service off and disabled. I don't know what service does the tray icon notification thing but it's not wscsvc (Security Center) unless Windows is lying to me and running a disabled service anyway.

[couttsj]

Thanks! That worked. Before I wasn't able to change the setting because I went right to disabling the service itself through services.msc.

@couttsj: the shield was showing up even with the service off and disabled. I don't know what service does the tray icon notification thing but it's not wscsvc (Security Center) unless Windows is lying to me and running a disabled service anyway.

That's a new one on me. I have never seen the Security Shield because it is almost the first thing that I disabled (lesson learned from XP). But then again, I am not using any of Microsoft's security features (they are all disabled). It could be that the firewall itself is able to trigger the notification. You can tell what services are running at any time using the Task Manager (right click in open space on the task bar).

J.A. Coutts

[rocket]

That's a new one on me. I have never seen the Security Shield because it is almost the first thing that I disabled (lesson learned from XP). But then again, I am not using any of Microsoft's security features (they are all disabled). It could be that the firewall itself is able to trigger the notification. You can tell what services are running at any time using the Task Manager (right click in open space on the task bar).

I think you're right. I know Windows Firewall has a bad rap but after realizing Vista added outbound protection, giving the option "Outbound connections that do not match a rule are blocked" (off by default, of course, courtesy of MS), I decided to stick with it. Making custom rules isn't that user-friendly, but once you figure out how to do this it's not bad.

[Spawn]

Turn the service and the security center back on.  Reboot.  Now the option will be available for you to change how it alerts you.  Now tell it not to notify you, then turn the security system off and go and disable the service.

Spawn

I am glad what I suggested worked for you.  You shouldn't have to do this, but apparently it is a glitch in Vista. 

Spawn

[couttsj]

I think you're right. I know Windows Firewall has a bad rap but after realizing Vista added outbound protection, giving the option "Outbound connections that do not match a rule are blocked" (off by default, of course, courtesy of MS), I decided to stick with it. Making custom rules isn't that user-friendly, but once you figure out how to do this it's not bad.

I have always found outbound blocking to be rather useless, since outbound connection requests usually use a dynamic port assignment to contact port 80 which is never blocked. Even the better backdoor programs now use port 80. What kind of rules did you come up with that would make it effective without being cumbersome.

J.A. Coutts

[couttsj]

While working on a different problem, I discovered that security center notification is a separate library function.

01/19/08  12:37 AM           224,768 wscntfy.dll

I am assuming that the notification process is a simple call to this library file, and it would be very easy to add it to another program or service.

J.A. Coutts

[couttsj]

Turn the service and the security center back on.  Reboot.  Now the option will be available for you to change how it alerts you.  Now tell it not to notify you, then turn the security system off and go and disable the service.

Spawn

While setting up a new computer, I had to do exactly as you have described above. I had 2 problems that were somewhat related. All Microsoft security features were disabled (as well as the Security Center), but I was getting a Windows Defender error and the Security shield popping up. There was an auto start attempt for Windows Defender in the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run section of the registry. Deleting it got rid of the Defender error. But the Security Shield kept popping up, and I had to follow your directions to get rid of it.

This all tends to support the theory that the Notification function is entirely separate from the Security Center service. It can be called from several different places because it is now a library function in Vista instead of an executable.

J.A. Coutts