Instructions on Hardening Windows (What I Have Learnt So Far)

Probably to allow users to use SAC in the future . If you don’t need SAC, do not allow optional diagnostic data.

3 Likes

I had the rule set to block (1) for Win10 IoT Enterprise and warn (6) for Win11 IoT Enterprise. Did not make a difference. I got the same error message / warning a user would get if they attempted to access something that needs administrator priveleges but did not have the correct credentials.

That seems to be more of an error message. To me, it would not seem to help anyone realize its the attack surface reduction rules blocking the program.

My suggestion is to switch to Windows enterprise edition.

It’s to make sure you can uninstall Edge and Bing if you want. To turn on SAC, you’d better turn on optional diagnostic data during the out-of-box-experience. After that, you can follow section 14.5 to turn off diagnostic data.

1 Like

It is an Enterpise edition of Windows. Not sure if the warn feature is worth giving up 7 years of extra support on the w10 machine.

Even for people using a more common version of Windows, knowing where to lookup the GUID and see what rules they are actually adding is, I think, a good thing.

You can change to a more modern hardware for better security. see section 0 for the recommendation.

2024/3/8 Update:
As DMA comes into effect, there are several changes to this guide.
15.11 Edge Telemetry
Edge in EEA no longer respects Windows telemetry settings in 14.5. A new policy is introduced in version 122: Computer Configuration > Administrative Templates > Microsoft Edge > Send required and optional diagnostic data about browser usage=enabled, off.

1 Like

Til i can uninstall edge if select EEA region,
Just pick a country Omg :scream::exploding_head:

P.s. dont forget to install a web browser app before uninstall, otherwise :rofl:

You could just curl from cmd if you forgot, right?

Yeh i think so. But would need to know url and command, probably pain in the arse. And i realised internet explorer was around. Had to get into windows features etc to turn it off. Geez MS sure does like forcing shit. Not as bad as apple though.

hey guys I created a new Windows Guide pr. everyone is welcomed to contribute!

1 Like

@fiwayan173 I wish I knew how to use GitHub, I can only edit text on Word, I am an academic in the making (maybe) by trade, so I can only improve text by these basic means.

Same. We can suggest improvements here :person_shrugging:

1 Like

GitHub is not that complicated and it’s much better suited to work on something than in a long thread on the forum.

1 Like

As this is one of the shorter threads I’m going to lock it and encourage future suggestions be made in: Windows Guide.

but it will take some work. Please continue discussion in the above thread.