# Instructions on Hardening Windows (What I Have Learnt So Far)

**URL:** https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102
**Category:** General
**Tags:** guide
**Created:** 2024-01-09T06:04:27Z
**Posts:** 54
**Showing post:** 25 of 54

## Post 25 by @anon34108895 — 2024-02-16T16:27:37Z

> [@Snowmanonahoe](#):
>
> Disabling the Microsoft UEFI CA caused my computer to stop POSTing.

Doing this is to only allow Windows to boot and prevent other OS from booting. Maybe your OEM drivers use this CA? Pls note that Windows bootloader does NOT use Microsoft UEFI CA.

> [@anon34108895](#):
>
> Disble logging in MS account in Windows system (you can still log in apps like Mails and Microsoft store) :Enable _Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options_\ Accounts: Block Microsoft accounts= **The user can’t add or sign in with a Microsoft account**.

This settings may cause problem in [WinRE](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference?view=windows-11#known-issue). Change it to _The user can’t add a Microsoft account_.

> [@anon34108895](#):
>
> Use [yubikey](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide) as local account 2FA method.

If you are using Yubikey, enable _Computer Configuration\System\Local Security Authority\Allow Custom SSPs and APs to be loaded into LSASS_

> [@anon29374801](#):
>
> Also a bit confusing that in GPO it states

I’m not sure if there’s warning mode on IoT Windows.

---

_[View the full topic](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102)._