# Any framework to harden Windows via containerized apps, virtualizing kernel...? **URL:** https://discuss.privacyguides.net/t/any-framework-to-harden-windows-via-containerized-apps-virtualizing-kernel/14008 **Category:** Questions **Tags:** os **Created:** 2023-09-18T01:35:05Z **Posts:** 7 ## Post 1 by @cromagnonymous — 2023-09-18T01:35:05Z I’ve heard one reason Macs are so secure against viruses and system crashed is that the kernel address space is virtualized, and apps can’t access it directly, like programs essentially operate in separate containers. Is there any framework to harden Windows in a similar manner? (I know Windows has [VBS and HVCI](https://www.tomshardware.com/how-to/disable-vbs-windows-11), but that that can cause significant performance decreases. Windows KDP partially virtualizes the kernel, but evidently [not designed particularly to resist malware](https://security.stackexchange.com/questions/249425/how-effective-is-windows-kdp-for-exploit-mitigation-in-practice). And while there’s something called [Wubes](https://github.com/nccgroup/Wubes) to replicate Qubes using Windows Sandbox, it seems more like a proof-of-concept than a robust framework suitable for a daily driver.) Is there anything effective to protect and virtualize Windows apps that I haven’t found yet? --- ## Post 2 by @cromagnonymous — 2023-09-18T01:38:34Z For context on my specific use case, I had to reset my PC recently so before installing a bunch of apps again, I’d like to know if there’s a more secure way to go about this. And please don’t recommend Linux; I have a separate Linux device and it’s wonderful but I need to have Windows on this particular PC, so I’m specifically looking to harden Windows 11. --- ## Post 3 by @cromagnonymous — 2023-09-18T02:00:19Z Update: I did just find this Privacy Guides PR for hardening Windows, which is somewhat informative. > > > Closes: #1380 > > This is a successor to #1380 Pull request by me. Things that ar…e there will follow here but in a paced manner with concise information. > > I have stated the reason in the old one for its closure. > > If you are suggesting big Changes, make a PR other than that do Code reviews. > > Do not comment about your suggestions in this PR as I want it clean and don't want it confusing either for me or to the contributors. So, Suggest them in Issue #166. I am following it. > > There will be no ETA for this. I will work on this in my Free time and try finish ASAP. So, is Sandboxie the thing I’ve been searching for, then? --- ## Post 4 by @anon55142611 — 2023-09-18T05:32:38Z Author of the PR here. There is an option to virtualize kernel as you asked. Search for Exploit Protection in Windows search. It will lead you to Windows Defender settings. In that, Flip the switches for **Force randomization for images (Mandatory ASLR)** and **Randomize memory allocations (Bottom-Up ASLR)** as _On By Default_ For Containerized apps, I would suggest you to wait though because Microsoft is bringing an API for tradition Win32 programs so it runs sandboxed similar to the UWP (MS Store) Apps or go for Sandboxie. --- ## Post 5 by @user1 — 2023-09-18T07:39:52Z This guide could also be useful. It’s in french but you could probably translate it easily. > **[Windows 10 : son modèle et ses fonctionnalités de sécurité](https://wonderfall.space/windows-hardening/)** > > Windows a longtemps été moqué pour sa sécurité supposément dérisoire ; il va sans dire que cela a sans doute été le cas pour ses précédentes moutures. Puis Windows 10 est arrivé, avec son lot de bonnes choses : Microsoft prend-il enfin la sécurité au... --- ## Post 6 by @sha123 — 2023-09-18T07:43:28Z See [https://hotcakex.github.io/](https://hotcakex.github.io/) for a possible hardening option. Also think about using wdac or at least applocker, if you don’t want to deal with wdac. --- ## Post 7 by @cromagnonymous — 2023-09-18T14:31:01Z What are the pros and cons of wdac and applocker, in your view? I’m not familiar with either