OSArmor

OSArmor is a Windows hardening tool from NoVirusThanks that watches every process launch and blocks behaviour typical of malware and ransomware, and it is aimed at admins who want an extra layer on workstations and small-business servers without running a full EDR stack. If you are searching for an OSArmor download, the key point up front: it is shareware (conditionally free) — you can evaluate it with a fully working trial, and continued use requires a paid licence.

OSArmor does not scan files for signatures. It looks at who started a process, with what command line, from where and with what signature, and stops patterns such as Word launching PowerShell, a script host running from a user’s Downloads folder, or vssadmin deleting shadow copies. It sits next to your antivirus rather than replacing it.

OSArmor at a glance

What it does

• Parent/child process rules: stops Office apps (WINWORD.EXE, EXCEL.EXE), PDF readers and browsers from spawning cmd.exe, PowerShell, wscript.exe, mshta.exe and similar tools.
• Protects shadow copies by blocking system utilities such as vssadmin.exe from deleting them — a common ransomware step.
• Filters command lines associated with malware, including encoded or malformed PowerShell commands and command lines that download remote files.
• Blocks executables with double extensions (invoice.pdf.exe), obsolete .COM/.PIF files and programs launched via autorun.inf from USB drives.
• Ships with more than 250 built-in policies, many of them individually switchable in the Configurator.
• Custom block rules and exclusion rules using variables for process path, parent process, command line, signer, MD5 hash, integrity level and user, with wildcard and PCRE regex support.
• Logs blocked events locally and to the Windows Event Viewer; a passive-logging mode lets you test rules without blocking.
• Enterprise edition: pulls rules and settings from a URL and sends blocked events as JSON via HTTP POST to your own collector.

How sysadmins use it

Roll it out on a pilot machine and tune the noise

1. Install OSArmor on one representative workstation with your normal software set and antivirus.
2. Leave the default protections on and use the machine normally for a few days, including your admin scripts, RMM agent and software deployment jobs.
3. Review what was blocked in the Events Viewer (or Windows Event Viewer) and decide which blocks are legitimate tools that need an exclusion.
4. Only then extend the rollout. Features such as blocking remote access tools or unusual PowerShell commands can hit your own RMM or scripts if you skip this step.

Allow a line-of-business app without weakening everything

Write narrow exclusion rules that match more than one field, for example signer plus path:

; Allow processes signed by Company XYZ located in C:Folder
[%SIGNER%: Company XYZ] [%PROCESS%: C:Folder*]
; Allow one tool with a specific command line
[%PROCESS%: *example.exe] [%PROCESSCMDLINE%: */safecommand*]

Add your own block rules, log first

1. Start the rule in passive mode so it only logs:

   [%PROCESS%: C:Users*Desktop*] [%SIGNER%: <NULL>] [%PASSIVELOGGING%: True]

2. Check the log for a week. If nothing legitimate appears, remove the passive flag and give the rule a name so it is easy to spot in notifications and Event Viewer:

   [%PROCESS%: C:Users*Desktop*] [%SIGNER%: <NULL>] [%RULENAME%: Unsigned exe on Desktop]

Manage many machines from one place (Enterprise edition)

1. In the Configurator use Export to save your tuned settings as an .ini file.
2. Place the .ini, CustomBlock.db and Exclusions.db on an internal web server.
3. Point each client at those URLs; OSArmor re-downloads them every 15 minutes, so one edit updates the whole fleet.
4. Set a URL for HTTP POST events and store the JSON in a database of your choice to see which PC blocked what.

Install and first run

Requirements. Windows 7 SP1 through Windows 11, 32- or 64-bit. Windows Server 2016, 2019 and 2022 are supported, but only with the Business or Enterprise licence — the Personal licence excludes servers and business use. The setup is roughly 50 MB and needs administrator rights, because OSArmor installs a service and a kernel driver.

First run. After installation the product runs in trial mode immediately with default protections. Open the GUI to review protections, custom rules and exclusions. To activate a licence, go to Help > License Status, enter the key and click Activate.

Gotchas.

• Activation and deactivation need Internet access. If you see “Failed to connect to the server due to network error”, allow outbound TCP 443 for NVTActivator.exe and NVTLicenseManager.exe (under C:Program Files (x86)NoVirusThanksNVT License Manager) and OSArmorDevSvc.exe.
• Replacing a CPU, SSD or RAM can change the machine fingerprint; deactivate the device in the Customer Portal, then activate again.
• To move a licence to another PC, deactivate it on the old one first (Help > License Status > Deactivate).
• Enable password protection on shared machines so users cannot switch protections off.
• Keep it updated: 2.0.7.0 fixed a reported vulnerability in the kernel driver.

Limitations

• Windows only. There is nothing for macOS or Linux.
• It is not an antivirus: it does not scan, quarantine or clean files. Keep your AV or Defender running.
• Behaviour rules produce false positives with admin scripts, installers and remote-support tools; plan time for exclusions.
• No free edition. After the trial every device needs a licence, and servers or business use require the Business or Enterprise edition.
• Central management is file- and URL-based. There is no ready-made management console — you build the web server, storage and reporting yourself.
• Licence activation depends on NoVirusThanks’ online servers.

OSArmor vs alternatives

Microsoft’s built-in Attack Surface Reduction rules and AppLocker/WDAC cover similar ground and cost nothing extra if you already have the right Windows and Defender licensing, but they need Group Policy or Intune work and careful auditing. OSArmor is quicker to deploy on a handful of machines and has a readable rule syntax. It solves a different problem from ClamAV, which is a signature-based scanning engine, and from Maltrail, which spots malicious traffic on the network. If you also want to see which programs talk to the Internet, GlassWire complements it at the network level.

FAQ

Is OSArmor free?

No. OSArmor is shareware (conditionally free): the trial is fully functional, after which each device needs a paid licence. Early versions were distributed free, which is why older reviews still describe it that way.

Where do I get the OSArmor download?

Use the Download button on this page to get the installer. The changelog, documentation and rule syntax reference are on the official site, osarmor.com.

Is OSArmor made by NoVirusThanks?

Yes. It is developed by NoVirusThanks Company Srl, which also makes the SysHardener utility. The old product page on novirusthanks.org now redirects to osarmor.com.

Does OSArmor replace my antivirus?

No. It is designed as an additional layer that blocks suspicious process behaviour; it does not detect or remove malware files. Run it alongside Microsoft Defender or another antivirus.

Does OSArmor work on Windows Server?

Yes, on Windows Server 2016, 2019 and 2022 — but only with a Business or Enterprise licence. The Personal licence covers home desktops only.

How do I stop OSArmor blocking a legitimate program?

Add an exclusion rule that matches the program’s signer and path (or its exact command line) rather than excluding a whole folder. Test with passive logging where possible.

Is OSArmor worth it for a small business?

It is worth a trial if your main risks are phishing documents, script-based droppers and ransomware on Windows PCs and you have no EDR. Budget time for a tuning phase, because behaviour blocking will flag some admin tools.

Last checked against official sources: 30 September 2026 (developer website: osarmor.com). Versions and licence terms change — confirm on the developer's site before deploying in production.