# Windows Guide **URL:** https://discuss.privacyguides.net/t/windows-guide/250 **Category:** Guide Suggestions **Tags:** invalid **Created:** 2022-10-05T04:48:05Z **Posts:** 370 ## Post 1 by @ikelatomig — 2022-10-05T04:48:05Z Hi, Some people know me by name in the Matrix room. I am working on the Windows Guide for PG. I am following Windows Hardening and Privacy Guide by Beerisgood on Github for this. I worked a lot on it. But due to many conflicts in the PR. I closed it and working on the same in a new one. I would like to get some advice on what should I add in my guide. The Guide will consists of 4 pages - Overview (Which you can see a preview in the PR) - Hardening - Sandboxing - Privacy Looking forward for your ideas, fellas. --- ## Post 3 by @anon82677111 — 2022-10-05T15:27:33Z I think a Windows guide is a good idea as many people cannot switch to Linux as it lacks software like Microsoft Office, Adobe Creative Cloud, and many games. Also Windows is a lot more secure than Linux. I agree with Beerisgood on a lot of things: 1. It’s a good idea not to install anti-spying tools like ShutUp10 but to use official documentation instead as installing extra tools increases attack surface and gives you another party to trust, and it’s always best to get information from first-party resources and not third-party ones, hence why TOS;DR was removed. In general it’s best to use first-party software as much as possible and avoid installing extra software. 2. Microsoft edge is the **only** browser I’d recommend for Windows users as it is the only one that natively supports hardware isolation and allows disabling JIT. 3. I agree that open source software like 7-Zip, LibreOffice, Veracrypt, and Firefox should be avoided as it’s less secure than Microsoft software. 4. I agree with most of the [Microsoft recommendations for the average home user](https://github.com/beerisgood/Windows11_Hardening/blob/3709e9f12d1b94e5b9d4b4671043e068230a3b5e/Microsoft%20recommendations%20for%20average%20home%20user). Paranoia about Microsoft telemetry is worse than the telemetry itself and using a Microsoft account does have security benefits and I see why Microsoft requires using a Microsoft account with Windows now, though it does allow Microsoft to spy on you even more. It depends on whether you prioritize privacy or security. > [@xeex](#): > > Simplewall is also good for security/privacy, user friendly ui for windows firewall to restrict internet access for apps Not really. You’re adding another party to trust simply for convenience. It’s best people learn to use Windows firewall. --- ## Post 4 by @jonah — 2022-10-05T15:46:28Z > [@anon82677111](#): > > Microsoft edge is the **only** browser I’d recommend for Windows users Hardly a cut and dry case. Microsoft Edge is also known for showing ads for malware on its home screen, bundling bloatware like invasive “buy now, pay later” services, and integrating “features” like automatic coupon/deal finding (which send your browsing history and bookmarks to Microsoft). It also doesn’t implement privacy features even _Chrome_ has standard, like end-to-end encrypted sync. > [@anon82677111](#): > > 7-Zip Microsoft does not have native tools which do what 7-Zip does (i.e. opening anything other than a .zip file). > [@anon82677111](#): > > Paranoia about Microsoft telemetry is worse than the telemetry itself Microsoft telemetry is literally a keylogger.\* Besides maybe Facebook and their complete lack of ethics and boundaries I’m having a hard time thinking of something pushed by a big tech company which is more invasive than Microsoft telemetry on Windows 10/11. I also can’t find any sources indicating a Microsoft Account user is more secure than a Local user at a glance, but I could be wrong about this. The only security advantage which comes to mind is automatic device encryption, which we specifically recommend against already in favor of a manual Bitlocker setup because “Device Encryption” sends your recovery key to Microsoft. \* Microsoft telemetry is _better_ than it was, I remember a lot of overblown articles about it when Windows 10 was Insiders-only, when pretty much all beta software will require deeper analytics/telemetry for product improvement because it’s… in beta. But Microsoft’s privacy defaults are still unsafe, their whole approach to privacy is a giant “just trust us!” black box. --- ## Post 5 by @anon34719932 — 2022-10-05T16:00:22Z > open source software like […] LibreOffice […] should be avoided as it’s less secure than Microsoft software. I wasn’t aware that LibreOffice is less secure than Microsoft software (I’m assuming you mean the Office 365 suite). I’m interested to know more (I currently use it): do you have any references I could read? --- ## Post 6 by @anon82677111 — 2022-10-05T16:16:53Z Microsoft Office can utilize MDAG (Microsoft Defender Application Guard). The free versions of Microsoft Office work inside web browsers and don’t allow active content on desktops. LibreOffice has no sandboxing preventing untrusted files from accessing trusted resources. If there was a vulnerability in LibreOffice [like there was a few years ago](https://thehackernews.com/2019/07/libreoffice-vulnerability.html), attackers can create documents that can execute malicious code onto your computer. --- ## Post 8 by @anon34719932 — 2022-10-05T16:39:19Z I didn’t know that the Application Guard supported Office: that’s great. And I’ll keep an eye on The Document Foundation’s security advisories. Thanks! :+1: --- ## Post 9 by @ph00lt0 — 2022-10-05T17:19:31Z I really like [privacy.sexy](https://privacy.sexy) to create my windows configurations. It also has settings i really wouldn’t recommend like disabling defender, but it’s very transparent and easy to configure. As Jonah pointed out the telemetry of windows **is** something to worry about. It really is super invasive (especially the non-EU version). We should advice users to limit this as much as possible. Microsoft accounts do not automatically enable device encryption actually, but device encryption is enabled by default under windows 11 (depending on hardware available). In my opinion it isn’t much more secure. An attacker can still add another administrator account and through this gain access to the user’ files using the same attacks that are known against local accounts, so this practically does not make any difference. Some things I recommend using: - [Bitlocker](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10) - [Local Security Policy (application whitelisting)](https://www.bleepingcomputer.com/tutorials/create-an-application-whitelist-policy-in-windows/) - [Endpoint Device Control Device (external device whitelisting)](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mde-device-control-device-installation?view=o365-worldwide) - [Microsoft Defender Application Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard#install-application-guard) - [Turn on network protection](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-network-protection?view=o365-worldwide#powershell) - [Enable virtualization-based protection of code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#how-to-turn-on-hvci-in-windows-10) - [Set up and use Microsoft Defender SmartScreen](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device) - [Enable attack surface reduction rules](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#powershell) - [Enable firmware protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection#windows-security-app) - [Enable blocking of Potentionally Unwanted Applications](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide#use-powershell-cmdlets-to-configure-pua-protection) - [Use Windows Sandbox for untrusted applications](https://techcommunity.microsoft.com/t5/windows-kernel-internals-blog/windows-sandbox/ba-p/301849) Note that some policies are not available under Windows Home and Windows Home N. You probably want to be using Windows Pro if any. --- ## Post 12 by @anon82677111 — 2022-10-06T00:15:51Z > [@xeex](#): > > Besides i do believe it’d be hypocritical for someone to use steam/egs/gog and install screw all anyways, yet reject simplewall for the purpose of reducing the attack surface. There is nothing hypocritical about this. Simplewall does not add anything new that cannot be done with the standard Windows firewall. How else is someone going to play Steam games? It may be better to just game on consoles instead of the PC. > [@xeex](#): > > In the past privacyguides used to at least have an equal ground when it came to security vs privacy, if not leaning towards privacy. Now I see security prioritised and privacy as a bonus. What happened PrivacyGuides became sane. One cannot have privacy without security and security is more important than freedom. It makes much more sense to use a Google Pixel than a Linux phone and a new Windows secured core PC or a Chromebook than a Thinkpad older than a decade. Security researchers are more trustworthy and reputable than free software activists. --- ## Post 13 by @deviancy — 2022-10-06T02:30:42Z I agree with most of your points from a very high level, but this: > [@anon82677111](#): > > security is more important than freedom is honestly a dangerous thought process to me. Putting faith into huge organizations with outsized power in the world is a recipe for disaster. Sure, getting malware is terrible and could potentially materially impact your real life if your bank account got drained as a result, for example. But by prioritizing security _this much_, one loses balance and view of the bigger picture, in my opinion. --- ## Post 15 by @ph00lt0 — 2022-10-06T13:10:06Z Since you replied to some of my recommendations. You cannot achieve privacy without security and neither the other way around. There are definitely differences but privacy and security more often overlap in their goals. The balance is hard to define but a large part of privacy, in context of today, is about data protection. Without good security you risk being infected or leak your data somewhere. You can really put a lot of effort in hiding with projects giving you a lot of privacy but no security until one day you get pwned and everything you worked for is gone. In the current day security risks are really high, especially for individuals seeking privacy. We have got enough proof for that seeing cases like Pegasus (the possibility of this I have warned people for for years). And many have been shocked by the wide spread of these attacks, and we yet have seen only one of them. May it serve as an example of what is possible and how little we know what is out there. To put it simply without security your privacy protections are worthless. This sometimes means you need to make compromises. Also note we never recommended Windows in the first place. But given you already trust Microsoft (by using it) you may as well use them to secure you instead of being even more vulnerable. If you need a higher standard of privacy: DO NOT USE WINDOWS. --- ## Post 16 by @anon82677111 — 2022-10-06T14:16:11Z > [@xeex](#): > > This website’s called privacyguides not securityguides, i believe we should at least have an equal ground when it comes to privacy vs security, if not lean towards privacy. Yes but you can have privacy without freedom. You can’t have privacy without security. > [@ph00lt0](#): > > If you need a higher standard of privacy: DO NOT USE WINDOWS. If you need a higher standard of privacy, you should use GrapheneOS on the newest Google Pixel and nothing else. Linux and OpenBSD are a security nightmare. --- ## Post 18 by @anon82677111 — 2022-10-06T15:17:09Z > [@xeex](#): > > First off, literally anything is more secure than windows right now. Apps outside the microsoft store (which in itself is a meme) run wild with no sandboxing and with a mostly yes(to everything)/no permission system. Which is why you only install apps from the Microsoft store. Windows out of the box is far more secure than Linux out of the box and it can be hardened like any other operating system. Out of the box, ChromeOS is the most secure, then macOS, then Windows, then Linux. I agree that Linux can be made secure once hardened but most people aren’t expected to harden Linux enough to where it matters and really are better off using Windows, macOS, or ChromeOS. OpenBSD has no GUI isolation as it uses Xenocara (a fork of Xorg) instead of Wayland, making it impossible to fully sandbox apps. It also lacks proper verified boot among other mitigations and the mitigations it does have aren’t as good as the ones found in proprietary operating systems. To call OpenBSD a secure operating system is like calling Lynx a secure browser. OpenBSD is a meme. Source: [https://isopenbsdsecu.re/](https://isopenbsdsecu.re/) --- ## Post 20 by @samsepi0l — 2022-10-06T15:57:04Z I think sandboxie has some major security concerns afaik. Using Windows Sandbox is better --- ## Post 21 by @anon82677111 — 2022-10-06T17:30:00Z True. Using third-party software for security usually increases attack surface and weakens the Windows security model. --- ## Post 24 by @user1 — 2022-10-07T07:52:13Z I think everyone here as a valid point: security, privacy, attack surface, freedom, etc. are all important subjects but I think we are losing sight about threat model. We’re talking about the Windows guide section, the average user here has a pc probably with an office suite, some games, utilities like 7zip, pdf reader, music and video player and more. I’m all into minimal setup but imo it is not realistic nor useful to simply promote “do not install anything outside MS” cause it potentially increases attack surface. It’s quite useless to have a PC that can’t run software. So the question for me should be how can we run software without too much compromise security and privacy and usability. The GrapheneOS approach is a great example, it’s secure, hardened and it still retains a great usability and user experience. To block network use you don’t have to install a firewall app or mess around with obscure settings, you just flip a switch. Now Windows it’s not so easily manageable in that regard and if it’s not simple enough people just don’t use it, so a relatively easy approach should not be totally dismissed (I also think disable telemetry here). So, are third party sandboxes, firewalls, privacy scripts, etc. worth to improve the security/privacy/usability Windows balance? --- ## Post 25 by @anon82677111 — 2022-10-07T15:28:22Z > [@user1](#): > > We’re talking about the Windows guide section, the average user here has a pc probably with an office suite, some games, utilities like 7zip, pdf reader, music and video player and more. > I’m all into minimal setup but imo it is not realistic nor useful to simply promote “do not install anything outside MS” cause it potentially increases attack surface. It’s quite useless to have a PC that can’t run software. So the question for me should be how can we run software without too much compromise security and privacy and usability. By only installing software that we need and using what’s provided by Microsoft whenever possible. In general, it’s advised to stay away from desktop apps and use the web browser for most activities including Email as websites in a browser are much less privileged than native apps and installing extra software can increase attack surface. Games and apps like Spotify and Discord are fine if they are required but it is possible to do a lot of this inside the browser. - If one cannot afford Microsoft Office, they should use the free versions that work inside a web browser and don’t allow active contents in desktops. - Use your browser’s built-in PDF reader. You can download the PDFs and then turn off your internet connection to prevent network connections from being made while reading the PDF. - Use the default music and video players that come with Windows. - Use Bitlocker for encryption as Veracrypt breaks secure boot. - Use [Bandizip](https://www.bandisoft.com/bandizip/) as 7Zip lacks [anti-exploit](https://malwaretips.com/threads/winrar-or-7zip-whats-your-favourite.89053/page-6#post-861699) and [MOTW](https://malwaretips.com/threads/winrar-or-7zip-whats-your-favourite.89053/page-3#post-800003) support. - Do not install a bunch of security software and stay away from cleanup tools like CCleaner, anti-spying tools like ShutUp10, backup software (use cloud storage or USB drives for backups), and third-party uninstallers like Revo Uninstaller. It’s best to use the default Windows Defender instead of installing a third-party antivirus. > [@user1](#): > > So, are third party sandboxes, firewalls, privacy scripts, etc. worth to improve the security/privacy/usability Windows balance? Firewalls and privacy scripts are not. Use official documentation from Microsoft. I have not used Sandboxie so I can’t really speak for it, though generally third-party security software can weaken the desktop security model like VeraCrypt does. [Hard\_Configurator](https://github.com/AndyFul/Hard_Configurator) may save a lot of time hardening the system. --- ## Post 27 by @Fossforus — 2022-10-11T05:29:34Z I’ll let others deal with the misinformarion in this thread… To the op CSI benchmarks are the gold standard baseline that even the biggest companies use. Many sysadmins and Cybersecueity professionals in my professional experience (and most sysadmin forums) will agree. You can do a search on your preferred engine to easily verify my claims. Note: it’s good practise to paste thinks in full, on forums and emails, where feasible. Non-exhaustive (sample) Sources for comments on CIS: > **[Reddit - The heart of the internet](https://www.reddit.com/r/sysadmin/comments/9j3bpi/who_uses_cis_benchmarks/)** > **[Linux security and system hardening checklist](https://linuxsecurity.expert/checklists/linux-security-and-system-hardening)** > > Increase the security of your Linux system with this hardening checklist. With the step-by-step guide, every Linux system can be improved. Link: > **[CIS Downloads](https://downloads.cisecurity.org/#/all)** Search for “Windows Desktop” and your Linux distro for Linux users. NIST and STIGs are also considered authoratative standards in the industry NIST (National Institute of Standards and Technology) STIGs (Security Technical Implementation Guides). Aside from these resources you should identify common threat models and usage goals to tailor the benchmarks accordingly into different ‘profiles’ that are relevant to readers. From memory when running through BeerIsGood’s guide there were some flaws in his thinking, that caused me to stop reading part way through, I’m no longer a windows user so I’m not going to review it again to be more specific. --- ## Post 28 by @Jimmy — 2022-10-11T09:47:12Z > - Do not install a bunch of security software and stay away from cleanup tools like CCleaner, anti-spying tools like ShutUp10, backup software (use cloud storage or USB drives for backups), and third-party uninstallers like Revo Uninstaller. It’s best to use the default Windows Defender instead of installing a third-party antivirus. It’s worth noting that Microsoft lets you uninstall a lot of apps with the [winget package manager](https://learn.microsoft.com/en-us/windows/package-manager/winget/) (If you don’t like Cortana it’s as simple as `winget uninstall Cortana` for example), so third party uninstallers aren’t really needed. Though of course it’s best to clean install Enterprise/Education so as to be able to have minimal bloatware and easy disabling of telemetry out of the box. If one isn’t a student/can’t afford either/isn’t willing to use MAS, then I think Pro still has less bloatware out of the box (though telemetry can’t be fully disabled like on Enterprise/Education). --- ## Post 29 by @Register3435 — 2022-10-11T09:58:42Z [https://www.softscheck.com/en/privacy-analysis-windows-10-enterprise-telemetry-level-0/](https://www.softscheck.com/en/privacy-analysis-windows-10-enterprise-telemetry-level-0/) If you are going to forgo clean-up and blocking scripts, then I think the suggested Group Policy edits need to be quite extensive. Telemetry: Level 0 isn’t a catch all to stop Windows from sending data completely. --- ## Post 30 by @anon82677111 — 2022-10-11T14:38:29Z I think Sandboxie should **not** be recommended as it doesn’t have any hardware isolation unlike [Windows Sandbox](https://techcommunity.microsoft.com/t5/windows-kernel-internals-blog/windows-sandbox/ba-p/301849), which uses [Hyper-V](https://en.wikipedia.org/wiki/Hyper-V), making it much harder for malware to escape. Sources: [https://malwaretips.com/threads/windows-sandbox-vs-edge-application-guard-window-which-is-safer.93405/#post-821946](https://malwaretips.com/threads/windows-sandbox-vs-edge-application-guard-window-which-is-safer.93405/#post-821946) [https://malwaretips.com/threads/windows-sandbox-vs-edge-application-guard-window-which-is-safer.93405/page-2#post-822054](https://malwaretips.com/threads/windows-sandbox-vs-edge-application-guard-window-which-is-safer.93405/page-2#post-822054) [https://malwaretips.com/threads/sandboxie-should-be-avoided-in-2019-and-above.93426/](https://malwaretips.com/threads/sandboxie-should-be-avoided-in-2019-and-above.93426/) --- ## Post 32 by @anon86352167 — 2022-10-20T12:12:09Z I’m currently in the process of helping @Edward make this Windows guide. Our main question is if using a Microsoft account in Windows adds anything beneficial security wise? A local account is better privacy wise and could have a reduced attack surface since it isn’t tied to an account but is there any real justification to have it tied to an account? P.S if y’all have any additional ideas or recommendations for the Windows guide I’d love to hear them! --- ## Post 33 by @user1 — 2022-10-20T17:48:31Z Here’s some subjects I would like the windows guide could clarify/suggest: - Intro on secure boot, bios security settings - Differences between Windows 10 home vs Windows 10 pro/enterprise ? - Offline account vs Online account (also user account vs admin) - Privacy settings - Telemetry (do we need some third party disabler?) - Group policies settings - Bitlocker (also on external devices, probably merge the os full disk encryption section) - Security settings / Hardening - Windows Store pro and cons - Windows Firewall - Windows Sandbox use cases - Windows Defender - Recommended third party privacy software (sandboxes/firewalls/privacy scripts/etc.) --- ## Post 34 by @jonah — 2022-10-20T23:17:44Z > [@anon86352167](#): > > Our main question is if using a Microsoft account in Windows adds anything beneficial security wise? As far as I’m aware using a Microsoft Account is the only way to enable Device Encryption on Windows 10/11 Home, however we already have a guide to enable Bitlocker as an alternative on the Home edition instead. --- ## Post 35 by @anon86352167 — 2022-10-21T13:57:12Z Perhaps so, i’ll have to look into it more. Also Home would be the least recommended edition of Windows ofc but i know that is hard to avoid sometimes --- ## Post 36 by @anon86352167 — 2022-10-21T13:59:44Z We’ll keep this in mind, thanks! --- ## Post 37 by @128bitpotato — 2022-10-21T18:28:31Z I’m relatively new to the privacy/security subject and really looking forward to the windows guide since I use it for my gaming PC. Though besides gaming I also use it for other stuff like banking, mail, excel and word. I’ve done some hardening with help from beerisgood and tried to weigh security and privacy along with functionality. My threat model is mainly focused on surveillance capitalism and passive attacks, maybe mass surveillance to some degree; I’m not looking for complete anonymity. Really eager to know when we can expect this guide to be released? (sorry for the impatience) Privacy guides is my go to because of its simplicity yet educating format. Some things I’d like to learn more about in the guide are: - Microsoft account pros and cons, as opposed to local account - If Microsoft account is needed (in my case since I got a family 365 account through a relative), how to enhance privacy and security - How to minimize telemetry, and information on what will actually be sent to Microsoft (assuming they aren’t actively ignoring settings) when configuring it as low as possible - Recommended backup configuration - I know beerisgood only recommends Edge as browser, of course there’s been different opinions on this, though I can understand the point made. How does this apply to email clients? Would outlook be a preferred client over Thunderbird if one has office? - Again I see the ongoing discussion and recommendation to use Bitlocker for system encryption. Does this go for external drives as well, or does it matter in that case? - A major bonus would be if there were any information if certain settings have major performance impact. I understand it’s not prime focus but read that some security settings, like memory integrity, can have a noticeable impact on performance. When gaming performance is essential and It’s really hard to find hands on info on what your sacrificing by turning it off, like performance vs security gain. Thanks for all the work on this, it is greatly appreciated! --- ## Post 38 by @anon86352167 — 2022-10-21T19:32:17Z Also good points to consider as well. I’ll look them over. Thanks! P.S do you have a link about the beerisgood edge recommendation? --- ## Post 39 by @128bitpotato — 2022-10-21T20:55:01Z > [@anon86352167](#): > > P.S do you have a link about the beerisgood edge recommendation? Sure, I got the impression before that his windows hardening guide was partly being used for the PG windows section, but I might be wrong? Anyway, in his [Windows 11 hardening guide](https://github.com/beerisgood/Windows11_Hardening) there is first a section under “Requirements” that reads: > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, … And then under “Hardening” there’s another section that reads: > use the only browser on Windows [that natively supports](https://docs.microsoft.com/en-us/deployedge/ms-edge-security-for-business) hardware isolation: Edge Now I’m not sure if this is completely up to date since from what I understand Firefox has made some significant security progress the last year? Though the application guard used in edge is probably as isolated as a browser gets from the rest of the system? At the moment I use Firefox myself for everyday use and edge when sites brake because of settings in Firefox or when I want the full isolation. (more links with info in the guide, couldn’t link in this post since new users only gets 2 links per post) --- ## Post 40 by @anon86352167 — 2022-10-21T21:15:23Z Edward may know about this guide but if not i’ll share it I didn’t know about 7-zip but that’s good to know FF has improved quite a lot but the core issue is the engine/sandboxing, FF is pretty behind Chromium’s sandboxing so unless they really tighten it up they can’t fix it properly unless they improve it. Thanks for sharing the guide! --- ## Post 41 by @Phvqkrpa2khYhnS5wA7kLVpg_Zes — 2022-10-21T21:35:38Z From what I’ve read here, Bitlocker is only recommended for Windows because it minimizes evil maid attacks. For external drives, I would use VeraCrypt. --- ## Post 42 by @jonah — 2022-10-22T03:08:34Z I believe we say this on the website, that Bitlocker is only recommended for the **boot drive**. So it’s perfectly acceptable and probably better to use Veracrypt on external drives, if that’s not clear we should make it clear. --- ## Post 43 by @ikelatomig — 2022-10-22T03:11:32Z It’s better to use Bitlocker for **fixed** drives on PC and use Veracrypt for removable/External drives ? --- ## Post 44 by @jonah — 2022-10-22T03:13:47Z I don’t think there’s a reason to use Bitlocker for fixed, secondary drives either. Only for operating system drives. --- ## Post 45 by @ikelatomig — 2022-10-22T03:19:57Z It depends on the user though. If you use Bitlocker for both Drives with a Startup PIN. The Boot follows like this. Enter PIN → TPM releases Keys → OS drive gets decrypted → key for secondary drive gets released and decrypted → OS boots → Login Screen I prefer this way because without Startup PIN. No data can be accessed. Why do you prefer Veracrypt for Secondary drives - for Cross compatibility & accessing in other devices in case you screw something on OS & you can’t access data forever or something else ? I will mention this though. I am suggesting this as it is a built-in solution and better than third-party, Veracrypt. This might feel as 1 factor but not until I add Startup Key + PIN. --- ## Post 46 by @jonah — 2022-10-22T03:24:45Z I don’t think Bitlocker is a problem to be clear, it’s perfectly fine to use it for all your drives IMO. But Veracrypt is open source and gives you a lot more flexibility in regard to every aspect to encrypting your drive compared to Bitlocker. And it doesn’t try and trick you into uploading your keys to your Microsoft account. And it’s cross-platform. All I’m saying is that Bitlocker is objectively better at encrypting your boot drive if you run Windows, but when it comes to all other drives then alternatives like Veracrypt are equally fine. --- ## Post 47 by @ikelatomig — 2022-10-22T03:26:19Z > [@anon82677111](#): > > it is the only one that natively supports hardware isolation If I am right, It does provide Isolation when you use Microsoft Defender Application Guard but not sure in normal ones. Do remember that MDAG bypasses VPN as it is isolated from host totally. --- ## Post 48 by @ikelatomig — 2022-10-22T03:27:35Z I agree. I will suggest both and emphasis on to use Veracrypt with the use case I mentioned previously. You wanna add anything to it ? --- ## Post 49 by @ikelatomig — 2022-10-22T03:35:52Z I might need some help on understanding ASR rules. Network protection seems like Badness enumeration. I presume we need to apply the rules. I agree with idea of Application Whitelisting. A brilliant one. I don’t recommend privacy.sexy to disable stuff but things that it recommends to disable could be taken into account. --- ## Post 50 by @ikelatomig — 2022-10-22T03:41:08Z > [@xeex](#): > > lack of sandboxing would apply to any non microsoft store You can’t say so because of upliftments in restrictions on store by Microsoft there are Win32 apps without Sandboxing & also UWP apps without sandboxing. You can’t determine if it’s sandboxed or not unless you see `Use All System Resources` in the permissions that the app request for in store. If you see it, It has no Sandbox. --- ## Post 51 by @ikelatomig — 2022-10-22T03:43:09Z > [@anon82677111](#): > > There is nothing hypocritical about this. Simplewall does not add anything new that cannot be done with the standard Windows firewall. How else is someone going to play Steam games? It may be better to just game on consoles instead of the PC. Blocking all Incoming connections reduces attack surface by large scale. Which can be done with few clicks in Windows Firewall settings. You don’t need SimpleWall in that case ? --- ## Post 52 by @ikelatomig — 2022-10-22T03:46:34Z I think this ain’t the place for Windows vs Linux other than recommending stuff for the guide. --- ## Post 53 by @ikelatomig — 2022-10-22T03:51:03Z > [@xeex](#): > > planning on manually opening 20 windows sandbox You can only open one at a time. Sandboxie : It just escapes Hardware isolation provided by Hyper-V which ain’t good, IMO. --- ## Post 54 by @ikelatomig — 2022-10-22T03:54:18Z Something other than Bandizip would be better. Maybe PeaZip ? Agreeable with lot of other stuff. --- ## Post 55 by @ikelatomig — 2022-10-22T04:00:01Z This makes me thinking. --- ## Post 56 by @ikelatomig — 2022-10-22T04:05:43Z You are right, the guide is sort of built from beerisgood. He will be credited when I finish this. --- ## Post 57 by @ikelatomig — 2022-10-30T14:29:22Z I am currently trying to work back in the guide. I need to know a explanation of the following from Beerisgood guide : - What would be the use of Microsoft defender Credential Guard, Network Protection, Attack surface Reduction rules from an average user Standpoint ? (It doesn’t make sense for me as these are focused towards Enterprise protection) - Cloud Delivered protection which is basically opting into sending metadata about the files to Microsoft for increased Security but loosing privacy when we try to balance. I think I won’t add the above. * * * Addition I will make : - Validating enabled stuff - Disable Autoplay of USB or other devices to prevent malware execution. - List about Smart App control and use in Evaluation mode only and enable if it is best for your setup - Suggest using EFS for sensitive files if there are other people using the PC from another user account or just stick to Bitlocker if the device is only used by you - Other Zip software instead of 7-zip to consider MoW feature. & several others that seem fit for general users. * * * Privacy : - Restriction of data access by other users. - Disabling Full Telemetry or suggesting required Telemetry - Randomizing MAC address - Tell about Delivery Optimization - Disabling Advertising ID in settings Other stuff by @user1 * * * I don’t know what else to add. I will try to refresh the preview --- ## Post 58 by @ikelatomig — 2022-10-30T15:00:06Z Regarding 7-zip with the Mark of Web (MoW) thing. Peazip works as expected. Open Source, No need for Bandicap. --- ## Post 59 by @ikelatomig — 2022-10-31T13:51:38Z [How to Require UAC Passwords on Administrator Accounts: 7 Steps](https://www.wikihow.tech/Require-UAC-Passwords-on-Administrator-Accounts) - This will fix the the issue of using Basic User account along side unused Administrator account. Do you think UAC could be bypassed this way ? I don’t think it could be . --- ## Post 60 by @anon86352167 — 2022-10-31T15:22:36Z I dont think so either, good find! --- ## Post 61 by @anonymous21 — 2022-11-01T02:34:12Z I’m excited for the Windows guide. I have clients that require Windows so a Windows guide will be a great addition to the privacyguides site. --- ## Post 62 by @ikelatomig — 2022-11-01T03:49:05Z Well, Everybody are. Thing is When I get the right time or a single day without other works. I can finish and publish it as soon as possible. --- ## Post 63 by @ikelatomig — 2022-11-01T04:28:09Z Another thing to note down here : - I recommend PeaZip instead of 7-zip - For PC Cleaner tools such as CCleaner, It will be avoided at most cases even FOSS alternatives like Bleachbit as you can use Disk Cleanup and Storage Sense in Settings. At the same time Microsoft is developing its own cleaning utility for Windows. So, I think it would be the best case. - Any Chromium based browser is recommeneded as Firefox sandboxing is weaker than chromium. --- ## Post 64 by @Alex — 2022-11-03T04:16:55Z > [@ikelatomig](#): > > ![](https://forum-cdn.privacyguides.net/letter_avatar_proxy/v4/letter/a/04756a/48.png) anon82677111: > > > There is nothing hypocritical about this. Simplewall does not add anything new that cannot be done with the standard Windows firewall. How else is someone going to play Steam games? It may be better to just game on consoles instead of the PC. > > Blocking all Incoming connections reduces attack surface by large scale. Which can be done with few clicks in Windows Firewall settings. > > You don’t need SimpleWall in that case ? Also here’s an actual example of how an app like simplewall could, and actually did increase attack surface: [Security: Unprivileged users have full access to the filter engine · Issue #680 · henrypp/simplewall · GitHub](https://github.com/henrypp/simplewall/issues/680) --- ## Post 65 by @ikelatomig — 2022-11-03T15:34:17Z I am telling about reducing attack without using SimpleWall rather Built-in solutions --- ## Post 66 by @samsepi0l — 2022-11-04T14:50:13Z KISS guys, I think the most obvious things to do on Windows is to encrypt the drives, and update the OS. Installing third-party apps/solutions is subpar (or even useless) imho. --- ## Post 67 by @samsepi0l — 2022-11-04T14:56:53Z The reason why there’s so Linux servers is not related with security. Windows is quite secure, but Linux is not (even with hardened kernel). > **[Linux | Madaidan's Insecurities](https://madaidans-insecurities.github.io/linux.html)** > **[Linux Insecurities](https://privsec.dev/posts/linux/linux-insecurities/)** > > There is a common misconception among privacy communities that Linux is one of the more secure operating systems, either because it is open-source or because it is widely used in the cloud. However, this is a far cry from reality. > There is already a... --- ## Post 68 by @user1 — 2022-11-04T16:11:09Z I activated UAC for my admin account and it works perfectly, however it asks for password even when I open the task manager which is not required on a user account. Is there a way to avoid the UAC just for the task manager? --- ## Post 69 by @anon86352167 — 2022-11-04T18:09:22Z Same on my end, likely no since task manager has the power to stop/mofify services and applications so its a privileged application. --- ## Post 70 by @user1 — 2022-11-04T18:55:18Z Sure but it is weird that on a user account you don’t have to pass UAC for the same task manager --- ## Post 74 by @ikelatomig — 2022-11-06T09:35:21Z It is because you can run a new malicious process via Task Manager using ![image](//forum-uploads.privacyguidesusercontent.com/original/1X/9e7cb5f9e72b2a8b859214bfff87bc5a8d6dec49.png) in the Top Right corner with Admin privileges as below. To avoid it, It asks for a prompt. You can say that we need to click the option below the text box. But process can be opened in UAC as Task Manager is in admin mode sort of without any authentication. ![image](//forum-uploads.privacyguidesusercontent.com/original/1X/39acad8bf03f5de9b3455983381ca4fb837690b4.png) --- ## Post 75 by @ikelatomig — 2022-11-06T09:36:30Z If you block Outgoing connections you won’t be able to use Internet at all and need to approve connections on a per-domain or per-app basis which might be frustating for the user. --- ## Post 76 by @ikelatomig — 2022-11-06T09:38:08Z If you want to use multiple Apps in Windows Sandbox creating a Configuration or using Run in Sandbox tool would be better for you - [Run in Sandbox: a quick way to run/extract files in Windows Sandbox from a right-click on a file | Syst & Deploy](https://www.systanddeploy.com/2021/11/run-in-sandbox-quick-way-to-runextract.html) Thing with Sandboxie is it ain’t actual sandbox if you see technically just another user session inside it rather than actual containment. --- ## Post 77 by @root — 2022-11-06T15:04:55Z `SbieSvc`: [sandboxie-docs/Content/IsolationMechanism.md at 10ad1cd1f6e6627b875326065ceddbe45ff8cb87 · sandboxie-plus/sandboxie-docs · GitHub](https://github.com/sandboxie-plus/sandboxie-docs/blob/10ad1cd1f6e6627b875326065ceddbe45ff8cb87/Content/IsolationMechanism.md#isolation-mechanism) > The file system and registry virtualization is implemented on the user level in SbieDll, which is responsible for combining the data from the real system with the ones from the sandbox and for properly redirecting all access attempts. If that mechanism is improperly bypassed, it results in an access denied error. We can’t say it’s more useful than full virtualization in a VM but it’s still not “just a user-level runbox” or whatever it is you’re implying. At least use documentation to back your claims. --- ## Post 78 by @anon73250778 — 2022-11-09T14:55:36Z I would just like to comment, since this portion will be read and prescribed to normies in the future: - Ease of use should be considered a _ **top priority** _ because if a process gets really complex or takes a lot of steps, you will lose your Win10 user to the guide. - If your privacy/security measure significantly alters or slows down the user’s workflow, they will revert back out of sheer laziness. - In line with this, something with a _ **1-click install** _ is always desirable, and should cover common use cases. This is inherently difficult to do due to the variety of workflow. - Part of the 1-click install should be given 3 choices: - **Easy** - with mild changes to their workflow and whatever else maximum benefit we can provide to them - **Intermediate** - for those that are familiar with enough computers, mainly give the option to revert some changes so things stop breaking - **Advanced** - for people deep enough knowledge that should be using Linux but are too lazy. The idea is maximum protection, and let them fend for themselves, whatever breakage they encounter. - Now what Easy, Intermediate and Advanced does could be up for discussion here. --- ## Post 79 by @ikelatomig — 2022-11-14T03:10:33Z [https://deploy-preview-1659--privacyguides.netlify.app/windows/overview/](https://deploy-preview-1659--privacyguides.netlify.app/windows/overview/) [https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/) [https://deploy-preview-1659--privacyguides.netlify.app/windows/privacy/](https://deploy-preview-1659--privacyguides.netlify.app/windows/privacy/) [https://deploy-preview-1659--privacyguides.netlify.app/windows/sandboxing/](https://deploy-preview-1659--privacyguides.netlify.app/windows/sandboxing/) I have finished the Windows guide in my own way and did my best to it. These are the previews generated. Comment your opinions and tell what else you would like to be added. I ain’t a native english speaker. So, pointing out grammar errors are also welcome. --- ## Post 80 by @Lumber0147 — 2022-12-18T18:32:04Z Didn’t have time to read it, but here are my suggestions (OS is used for productivity & gaming) with focus on privacy. The guide could include How you could turn some of the telemetry in the registry or GPO. How to create an Installation USB Stick with Rufus, which can removes some telemetry stuff beforehand and also remove the requirement of the otherwise mandatory Windows Account Login at the installation process. Installaton of something like Portmaster, Simplewall or Adguard (paid) to block remaining telemetry. Using a piHole or Adguard Home with OS and application related blocklists, like Windows Spy Blocker (basic) and/or Kodo Pengins Mainlist (advanced). An important note to only use a local account. Imo Privacy and performance & compatibility should be valued over further security hardening since performance and compatibility of applications and games are the usual reasons why people use Windows instead of Linux. --- ## Post 81 by @128bitpotato — 2022-12-22T21:36:35Z I’ve read through the guide and it’s a thorough piece of work with a lot of essential information, much appreciated! > [@ikelatomig](#): > > I ain’t a native english speaker. So, pointing out grammar errors are also welcome. I’d be happy to contribute with correcting grammar and make the text a bit more fluid. I basically work with writing all day at a job where being academically and grammatically correct is essential, so even if English isn’t my native language I’m fairly confident in text. I had a lot of spare time today so here comes a deep dive in some thoughts I had while reading through. I’ll go through them in the same order as the guide. Under [Choosing your Windows edition](https://deploy-preview-1659--privacyguides.netlify.app/windows/overview//#choosing-your-windows-edition) in the second paragraph it says > If you cannot get the above editions, you **must** opt for Professional Edition. I would suggest using the word _should_ instead of _must_. This since the word _must_ is quite definite, making it seem like you have no other option. Even if Windows Home is severely limited we always have an option. People are usually more susceptible to suggestions rather than demands, and it makes for a more pleasant reading. Further down under [Editions to avoid](https://deploy-preview-1659--privacyguides.netlify.app/windows/overview/#editions-to-avoid) in the second paragraph concerning windows Home edition it says > It also uploads Bitlocker Encryption keys to Microsoft servers which actually defies the aspect of encryption implemented in a different way. I think this needs some more clarification. In what way does it defy the aspect of encryption? Furthermore, in the overview under [Installing windows](https://deploy-preview-1659--privacyguides.netlify.app/windows/overview/#installing-windows) I don’t really understand why suggesting the use of command prompt to flash iso? Why not just use media creation tool to easily format a USB in a user-friendly UI? I see it mentioned in a note further down that you just get the desired version that way and therefore save space, but 1gb more or less shouldn’t be a problem nowadays? Maybe instead suggest the command prompt way as a second solution or tip? Also, might be a good idea to point out to **NOT** download pirated versions since it the risk of it containing malware very high (yes people actually do this since it’s free, I never paid for Windows until finding the privacy community and started reading up on it). **Moving on to the hardening section** First sentence > If on Win11 be sure that you use it on supported hardware on I understand this is incomplete. But wanted to suggest elaborating on this a bit more, as in _why_ it’s important to be on supported hardware. Under [Security](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/#security) it says > UAC with password Not sure if this is incomplete, but also here I think it could be good to have a short explanation on why it’s important. Furthermore, under [Encrypting the drive](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/#encrypting-the-drive) in the info box about _Choosing the Way to Encrypt_, when talking about storing encryption keys on Microsoft account it says > This can be dangerous to your privacy and security as Microsoft could easily view your encrypted files, as could an attacker if they were able to gain access to Microsoft’s servers or any Law Enforcement could by a Gag order. I would suggest changing _Microsoft could easily view your files_ to “_anyone who gains access to your account_”. Not sure if we should imply that Microsoft views our encrypted files without proof that they actually do so, also it seems highly unlikely since it would gravely jeopardize their trust. With that said, a hacker or government gaining access is absolutely a real concern. Might also be good to inform here on why Bitlocker is preferred above other encryption software like Veracrypt. Next, under [Security policies for Bitlocker](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/#security-policies-for-bitlocker) I think it could be good to add some more insight as to why we change this. Personally I want to know what I’m tampering with to feel comfortable doing it. [Setting up pre-boot authentication](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/#setting-up-pre-boot-authentication) should probably come before Bitlocker setup since it’s clearly advised to configure pre-boot authentication first. Else people might do it in the wrong order if not reading through the whole guide first. In [Apps](https://deploy-preview-1659--privacyguides.netlify.app/windows/hardening/#apps) first section says > Avoid any types of Cleaning software at all cost. I think this needs some more explanation. Why should we avoid it? The same applies under Security improvements where it suggests to use Winget tool to remove Bloatware instead of third party apps. Why not third party? I think it would help to be clearer about how it increases attack surface by adding a third party to trust and that there are windows tools, a lot of them built in, that does the same thing. **Lastly in the privacy section** The first section, [Using Microsoft account](https://deploy-preview-1659--privacyguides.netlify.app/windows/privacy/#using-microsoft-account) states that > You should never sign-in to Windows with a Microsoft account. Signing-in to applications like Microsoft Office (which some users are required to do for their school or company) will trigger a dark pattern offering you to sign in to Windows, which will connect your device to your Microsoft account, and make it easier to send data to Microsoft servers and it is critical to reject this offer. Why should we never do this? Why is it critical to reject the offer? These statements makes it sound dangerous, and when something is dangerous we need to back it up with facts for it to be legitimate. Signing in to Microsoft isn’t dangerous to the average user. I think that instead of demonizing it the guide should suggest not doing it if the user strives for more privacy. But I also think there should be a section on how to adjust account settings for more privacy and recommendations on using a disposable mail, phone number, etc. Also, all telemetry isn’t bad, even if it might not be appreciated. Of course there’s the question about trust, but I’d be more than surprised if it turned out Windows privacy switches were just “dummies”. After configuring privacy settings to minimum telemetry the information sent is mainly diagnostic data and not very usable for tracking compared to full telemetry that tracks app usage, browser history and specifically aims to provide the user with a personalized “experience”. If you already trust Microsoft enough to use it, you might as well trust their privacy policy. Else your going to have to run it without plugging it to the internet at all. So that’s all. It’s a long awaited guide and with some tweaking I truly think it can help a lot of people. As you can see I’m a lot for educating the reader. I believe that it’s impotent to know why you do something, else you won’t learn anything and it’s hard to understand the point of it. There doesn’t need to be thorough explanations, but rather one or two sentences with a link to further reading. This is already done in the guide, it just needs to be applied a bit more. --- ## Post 82 by @Jimmy — 2022-12-23T20:37:07Z > Signing in to Microsoft isn’t dangerous to the average user. I think that instead of demonizing it the guide should suggest not doing it if the user strives for more privacy. But I also think there should be a section on how to adjust account settings for more privacy and recommendations on using a disposable mail, phone number, etc. [It’s worth noting that according to this study it seems that Windows collects more telemetry when signed into a Microsoft Account.](https://www.autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/public_version_dutch_dpa_informal_translation_summary_of_investigation_report.pdf) (Look at the list of identifiers sent on page 5-6.) --- ## Post 83 by @128bitpotato — 2022-12-25T13:42:06Z That’s indeed some good information that needs to be weighed against a persons threat model when considering signing up for an account. --- ## Post 86 by @ikelatomig — 2022-12-27T12:54:42Z > [@128bitpotato](#): > > _should_ instead of _must_. Done. > [@128bitpotato](#): > > In what way does it defy the aspect of encryption? Please check the new preview > [@128bitpotato](#): > > I don’t really understand why suggesting the use of command prompt to flash iso ? Because doing so, Will only have Enterprise, Education and Professional and removes Home edition from the ISO totally > [@128bitpotato](#): > > to **NOT** download pirated versions Done > [@128bitpotato](#): > > If on Win11 be sure that you use it on supported hardware on I think doing some copy paste work it made it upto the Top. Removing now. > [@128bitpotato](#): > > UAC with password Redundant, because of the last point under Creation of User Account and usage. There have been some conflicts while I am merging stuff, etc. Probably. I don’t know how. > [@128bitpotato](#): > > anyone who gains access to your account Done. > [@128bitpotato](#): > > Might also be good to inform here on why Bitlocker is preferred above other encryption software like Veracrypt. I stated a stuff. Check it for yourself. > [@128bitpotato](#): > > should probably come before Bitlocker setup Without enabling policies you can’t setup pre-boot authentication and the images are self explanatory. > [@128bitpotato](#): > > Why not third party? Because using Winget (Official Package manager) is better than breaking stuff with 3rd party tools. > [@128bitpotato](#): > > Why should we never do this? Why is it critical to reject the offer? These statements makes it sound dangerous, and when something is dangerous we need to back it up with facts for it to be legitimate. That’s why I suggested signing into that app alone. > [@128bitpotato](#): > > if it turned out Windows privacy switches were just “dummies They aren’t. Group policies are there to do thing strictly as follows. --- ## Post 87 by @eudyp — 2023-01-31T14:37:40Z Hi, I checked the Edge privacy settings, and if you turn off remote sensing in Group Policy, it seems to turn off Edge remote sensing as well. From: [Microsoft Edge enterprise privacy settings | Microsoft Learn](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-enterprise-privacy-settings) May be useful. --- ## Post 88 by @anon73250778 — 2023-03-01T22:54:25Z > Disable Windows spotlight by navigating to `User Configuration` \> `Administrative Templates` \> `Windows Components` \> `Cloud Content` and setting **Turn off all Windows Spotlight features** policy to disabled. !!! note This explicitly disables Windows spotlight features in Lockscreen and Desktop to severe unnecessary between Microsoft servers and the device. I could not find this particular spotlight entry. There were 4 entries in the Cloud Content policy folder and on cursory glance, none of it seem to have the word spotlight on it. Is this how I’m supposed to avoid seeing Candy Crush and the like in the start menu? * * * Since we are here in Windows land anyway, can we now discuss about responsible computer gaming like an adult? How should a dedicated Windows only device strictly for gaming ought to look like? I think I should open a different thread… --- ## Post 89 by @Jimmy — 2023-03-09T20:35:01Z This script here might be worth a look: [GitHub - troennes/private-secure-windows: Privacy and security baseline for personal Windows 10 and Windows 11](https://github.com/troennes/private-secure-windows) It basically applies a bunch of group policies from Microsoft’s restricted traffic baseline + windows security baseline/security compliance toolkit, and is compatible with Pro/Enterprise/Education. From what I can tell, it uses Microsoft’s own official tools to do so, so it might not need placing full trust in the author (as opposed to something like shutup10 which is not as easy to verify due to being closed source). --- ## Post 90 by @ikelatomig — 2023-05-10T16:23:48Z Hello everyone following here. Quick and Straight to the point. I loved doing and working on this PR and did a lot of research and wrote everything on my own personal experience. But the approval and many help **I** expected were disappointment. I have been a windows user. I still am. But I am unsure about my guide. So, It is to say that I am no longer working on this PR. This discussion and PR will be open though. I would work on further if there is attention and discussion with people and from PG team. If anybody want, they could help me in my PR by forking it or if the team wishes. They could close mine and create a new one. Even then, Old data could be used from mine. --- ## Post 91 by @anonymous71 — 2023-07-29T15:58:58Z > [@ikelatomig](#): > > I loved doing and working on this PR and did a lot of research and wrote everything on my own personal experience. But the approval and many help **I** expected were disappointment. Windows by far has the most users, a lot more than MacOS or Linux, so it would make sense to prioritize it because it will be useful to a lot more people. But Windows guide isn’t made yet, meanwhile MacOS guide is already done (and I think we all know why). Anyway, is there any Windows guide that I could use right now to configure my Windows install? --- ## Post 92 by @Viper — 2023-07-30T08:38:47Z theres a macos guide? link pls? --- ## Post 93 by @Mossturtlecoffee — 2023-07-30T09:06:31Z > **[Resumen de macOS - Privacy Guides](https://www.privacyguides.org/es/os/macos-overview/)** > > macOS es el sistema operativo de escritorio de Apple que trabaja con su hardware para ofrecer una seguridad sólida. --- ## Post 95 by @abstract — 2023-08-05T12:36:33Z Thanks for creating a Windows guide and recognizing that many users are “stuck” with using Windows, even though they would prefer to run an OS that fundamentally respects privacy. However, I would like to contest the point that argue for the necessity of running Windows under a standard user account. I would like to clear up that the default user account that Windows setup creates, and which it gives the user access to, is _not_ the actual Administrator account. To quote Microsoft: > Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. > (Source: [Local Accounts | Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#administrator)) That might seem like nitpick, but note that user accounts with administrator access (members of the Administrator group) do _not_ run the entire user session with administrator access. To quote Microsoft again (and I recommend reading this resource for more context): > By default, both standard and administrator users access resources and execute apps in the security context of a standard user. > (Source: [How User Account Control works | Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#sign-in-process)) To execute apps in the context of an administrator user, the explicit approval of the UAC prompt is needed in all cases (always assuming that UAC notifications are set to a high level). As such, for home users on non-managed systems\* it doesn’t seem to add any security benefit, as far as I can see, to run a local account as a standard user. Furthermore, it adds the inconvenience of having to enter a password for each and every UAC prompt; which I think only the most patient users are actually willing to do (I personally don’t expect most people to be willing to enter a long and complex passphrase simply for opening Task Manager). \*For managed systems, such as enterprises, it of course makes sense to limit administrator privileges to only a select group of people, and Microsoft naturally notes this in the second source I provided. --- ## Post 96 by @root — 2023-08-07T08:06:32Z > [@abstract](#): > > However, I would like to contest the point that argue for the necessity of running Windows under a standard user account. I would like to clear up that the default user account that Windows setup creates, and which it gives the user access to, is _not_ the actual Administrator account. Worth elaborating this in the Windows kb. --- ## Post 97 by @3QVvxrhnYZ — 2023-09-06T00:15:08Z > [@abstract](#): > > people to be willing to enter a long and complex passphrase simply for opening Task Manager Local accounts don’t need to enter any passwords to access Task Manager. That is: Local accounts don’t have to have Administrator privileges to access Task Manager. I’ve been using a Local account for a very long time, and I had the need to run ‘taskmgr.exe’ as an Admin only like 3-4 times during all the years that I’ve used a local account. Accessing Task Manager as an Admin is needed if a user wants to manage a process that runs with Admin privileges. For example: if you open Task Manager as a Local account and try to close a process which runs as an Admin — it will prohibit you from doing so. A better and more relevant example would be that Local accounts can’t access Group Policy Editor (gpedit.msc) with a Local user rights. They have to run it as an Admin. Anyway, during all the time I’ve been using a Local account, I’ve never been bothered by the need to enter a password to access/manage tasks which require Admin privileges exclusively. I’m fully okay with it and feel safer knowing that every process which wants to access Admin rights — will explicitly give me a UAC prompt. Furthermore, your [first link](https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#security-considerations) says: > As a security best practice, use your local (non-Administrator) account to sign in and then use **Run as administrator** to accomplish tasks that require a higher level of rights than a standard user account. Don’t use the Administrator account to sign in to your computer unless it’s entirely necessary. Besides that, I still think that it’s the best practice to isolate as much as possible, and create a dedicated, explicit Local account when installing and setting up Windows for the first time. You said: > but note that user accounts with administrator access (members of the Administrator group) do _not_ run the entire user session with administrator access. The keyword is “entire”. They may not run an entire session as an Admin, but some other parts of the profile _can_ run as an Admin. So, when a user uses an Admin account, can they be aware of _all_ the stuff that runs as an Admin? Can we precisely know what runs as an Admin, and what doesn’t? There are no simple ways, but there are of course tools to know what process runs with what privileges (like Sysinternals Suite), but we won’t and don’t want to be opening it every time just to see under what privileges the app runs. Try installing any Gecko/Chromium-based on an Admin account. It won’t give you a UAC prompt. Try installing it in a Local account — it will give a UAC prompt for an Admin password. If you refuse to enter the password, it then shows a pop-up (suppose we are installing Chrome): > Google Chrome can be installed without administrator privileges. Continue? You click “Yes”, and Chrome proceeds to install itself entirely in the Local account (%localappdata% or C:\Users%username%\AppData\Local). It sets registry keys only for the Local account (an Admin-installed app can set system-wide registry keys in _HKEY\_LOCAL\_MACHINE_, for example), and so on. _Last time I checked_ (and that was long ago), this won’t happen when you are using a default, Admin account. There’ll be no UAC prompt. Chrome will be installed as an Admin. My opinion is that using an explicit Local account is safer, and you don’t have to bother thinking which stuff runs as Admin, and which is not. When using a Local account, you will be notified every time when something needs Admin privileges. It’s just more clean, really. I agree however that for most users entering passwords in UAC prompts for installing, for example, games (or doing some other similar casual tasks), can be bothersome. Interesting fact is that (but that was in 2012) [a Chrome developer said that they allowed installing Chrome without Admin rights _not_ for security reasons:](https://groups.google.com/a/chromium.org/g/chromium-discuss/c/MrfbaVTH4NM/m/0v_QhBdDmPQJ) > Installing in AppData was never a security measure They only did so out of usability/UX concern: > Our data shows that _preferring_ a system level (Program Files) install with a fallback to user level improves the install success rate. --- ## Post 98 by @3QVvxrhnYZ — 2023-09-06T00:21:59Z > [@3QVvxrhnYZ](#): > > C:\Users%username%\AppData\Local Somewhy the backslash was automatically dropped by this forum. Seems like it doesn’t like \ + % combo. Here’s the edit with a “dummy” space: C:\Users\ %username%\AppData\Local --- ## Post 99 by @3QVvxrhnYZ — 2023-09-06T04:49:30Z > [@anon82677111](#): > > Microsoft edge is the **only** browser I’d recommend for Windows users as it is the only one that natively supports hardware isolation Edge’s hardware isolation requires using Application Guard, and using it is redundant and unnecessary for most users. The only practical use-case for end-users is if they know _in advance_ that the website is potentially malicious, and if they _still_ really want to access the website despite being suspicious, then they can access it via MDAG in just two clicks. Another option would be to just check website’s safety online, via services like [Quad9](https://www.quad9.net/result), [URLVoid](https://www.urlvoid.com) for links, and [Virus Total](https://www.virustotal.com) (works for links too) and [Hybrid Analysis](https://hybrid-analysis.com) for files, to test whether the file you want to download is malicious. Additionally, using Safe Browsing + a security-focused DNS would prevent them from accessing the website in the first place. Microsoft Defender Application Guard creates a virtualized environment: a Hyper-V Krypton container, which runs outside of Windows. This creates an overhead and takes resources, decreasing the UX of the user. It’s a classic “security vs convenience” dilemma. Furthermore, besides allocating hardware resources for isolation/virtualization, Edge’s MDAG must create [a new (isolated) Edge window](https://learn.microsoft.com/en-us/deployedge/media/microsoft-edge-security-windows-defender-application-guard/wd-application-guard-1.png) for an untrusted website, which is inconvenient for most users. Now, the documentation says that Edge runs only untrusted websites in MDAG. But what are untrusted websites? [From the documentation:](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard#about-application-guard) > The _enterprise administrator_ defines what are trusted sites, cloud resources, and internal networks. Everything that’s not in the trusted sites list is considered untrusted. Emphasis mine. So, to conclude: Edge doesn’t have any “untrusted websites list”, which could be preinstalled or fetched from the cloud. SmartScreen is responsible for that. Very obviously, MDAG for Edge is an enterprise-oriented feature, and Microsoft makes it very clear in their documentation. Administrator creates a list of trusted websites for an organization — a whitelist. All other websites run in an untrusted mode, which is a hardware isolation. This feature is really useful (even mandatory) in an enterprise environment, but not at all for end-users. Theoretically, an end-user could create a list of trusted websites for themselves, that they visit often (for example Twitter, Youtube, etc), and then all other websites would be automatically run in an isolated environment. However, as I said — this is really unnecessary. For maximum protection (i. e. a paranoid mode) one could just force MDAG to treat all websites as untrusted and therefore run _all_ websites in an isolated environment, but this is not an appropriate solution for end-users at all and is even more unnecessary, for the reasons mentioned in my first paragraph. As for browsing protection for end-users: For those who use Edge: it has SmartScreen, and SmartScreen is a very good protection for users. It was benchmarked against a list of dangerous websites and gave very-very good results, better than Google Safe Browsing. Also, Edge runs in an AppContainer, unlike other browsers. So Edge really _is_ secure enough for most users. For those who use other browsers (both Chromium and Gecko-based): most of the browsers fetch a list of dangerous websites from Google Safe Browsing. Even Gecko-browsers use it: Firefox uses it, Librewolf uses it (but disables it by default). Gecko-based browsers are less secure in regards to their technology, however they are fine for users who are educated regarding internet safety, have good security hygiene and are able to recognize a threat (simple rules, like “don’t click suspicious links”, and so on). For the general majority it’s best to use up-to-date Chromium-based browsers, preferably installed from Microsoft Store, due to MSIX. In Microsoft Store there are: Edge, Brave, Vivaldi, Opera. I would recommend only Brave, despite all the controversies and the fact that it isn’t recommended by Daniel Micay. I also fully understand the frustrations and annoyances of other people regarding all that integrated crypto-stuff and other unneeded/unwanted features, which I dislike too. (I only like its WebTorrent extension, which allows to download torrents without having a desktop client, and its ability to set custom keyboard shortcuts for any action in the browser — it’s a killer feature for keyboard power-users, and for productivity in general. Really speeds up my workflow.) Nonetheless, we have to choose from what we have and I think Brave is the only decent option we have among Chromium-based browsers, despite the controversies and the CEO. There’s also an option to download Chromium directly from Chromium developers and auto-update it (and it’s very simple), however Chromium isn’t appropriate for general usage at all for many reasons. Security-paranoia related to Edge’s MDAG is highly unnecessary and using MDAG for Edge is an overkill for most users. We shouldn’t be trading all the bits of our privacy and shouldn’t expose ourselves to the intrusiveness and nagging that Edge has, in exchange to just get Edge’s native isolation feature, which is redundant for most users. It is the pursuit of imaginary protection, disregarding the means by which this protection is achieved (using Edge). For most people, there is no security benefit in using MDAG in Edge. The benefit for privacy from not using Edge, however, is big, as Edge has lots of privacy concerns. It records your PC’s hardware UUID¹ and sends it to Microsoft’s servers, thus creating a completely unique identifier which _cannot_ be deleted, and which can track you not only in Edge itself, but across all apps from Microsoft). There are lots of other concerns. A browser is a very intimate thing which we need to be mindful with, and we shouldn’t disregard the privacy aspect of a browser. People do lots of personal stuff there and store private, personal data: browsing history, bookmarks, and some people store passwords in their browser, which they shouldn’t do. Safe Browsing feature, which in combination with a security-focused DNS (such as Quad9 or NextDNS) acting as a fallback — protects most users from accessing harmful websites in the first place, and it is extremely easy to set up and configure. The fact that Edge has only one specific feature, which is a native hardware isolation — really cannot act as an excuse and justification for all the invasiveness, nagware, and privacy-concers that Edge has. This is an enterprise-oriented feature and it provides little value for most users/for casual browsing. Besides MDAG for Edge, advanced security-paranoid users can also configure an additional sandboxing option in Edge and other Chromium-based browsers via Group Policy Editor or Registry Editor: they can can turn on [Network isolation](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#networkservicesandboxenabled), which is disabled by default in all Chromium-based browsers. Currently this feature is being tested and is not enabled by default in ‘edge://sandbox’. ¹ However, Microsoft has been storing hardware’s UUIDs on their servers for a long time already, but for legit purposes, for example to activate your Windows automatically when you re-install it. Even if you completely wipe your hard drive, install Linux, uninstall Linux, and install Windows — Windows will activate itself automatically (if you were using it before), as your hardware UUID is already stored on their servers. They match your hardware UUID with your activation key, and activate Windows for you. --- ## Post 100 by @Torsten — 2023-09-07T01:15:32Z Wow crazy how your view is soo different. How can you say any proprietary Software is secure if no neutral entity looked at their code? Prefer Edge over Firefox “because isolation”?? Its a privacy nightmare. You have to admit THIS view is security only, and not even really provable in some cases. When where you hacked through an unisolated Browser? When has your Browser spied on you? --- ## Post 101 by @Torsten — 2023-09-07T01:17:51Z Why not just use UBlock and Noscript? No website will hack you if its blocked (in a privacy respecting way) or malicious Javascript is opt-in? --- ## Post 102 by @anon73250778 — 2023-09-07T04:52:36Z > [@Torsten](#): > > When where you hacked through an unisolated Browser? Isnt most malware vectors come from clicked links in browsers? --- ## Post 103 by @3QVvxrhnYZ — 2023-09-07T05:13:53Z > [@Torsten](#): > > Why not just use UBlock and Noscript? No website will hack you if its blocked (in a privacy respecting way) or malicious Javascript is opt-in? NoScript is unnecessary because browsers can block/allow Javascript natively (without any extension) per-site. Using similar “privacy/security-enhancing extensions” is a wrong approach and is a so-called badness enumeration. > [@Torsten](#): > > Wow crazy how your view is soo different. Yeah, that person is clearly oversaturated on security and their priorities are shifted towards security exclusively. They also mentioned disabling JIT. Like, tell me: among the general population, who the f\*\*\* would deliberately degrade their browser UX by disabling JIT, which heavily slows down browser’s performance (especially on Android, as per my tests)? The most annoying aspect of disabling JIT for most people would be the page loading delay. Or, simply put: with JIT disabled, users will have to wait much more until their page gets rendered. Disabling JIT for most users = a giant degradation of browser experience, and a very tiny, maybe even impalpable security benefit, because the chance of an average user getting exploited via a JIT compiler vulnerability is very low. We shouldn’t say “I only recommend Edge due to MDAG, also disable JIT cuz sekuritee! :shield:”, but we should take into consideration in what environments/under what circumstances we should use MDAG and disable JIT. Both MDAG for Edge and JIT are _not_ applicable for casual/general web-browsing. We shouldn’t get too security-frenzied here and just ignore all the privacy- and telemetry-related concerns (by ‘telemetry’ I mean the bad kind of telemetry, that which is not used for the benefit of the user). We should instead find ‘the golden mean’ between privacy and security. MDAG does nothing for most user’s security. For it to be doing something, one should configure a whitelist of trusted websites for themselves, which will run without MDAG, and all other websites, in turn, will run in an untrusted mode — in MDAG, and this all is extremely bothersome and ridiculously unnecessary. Otherwise there’s no use for it for the overwhelming majority, except for an enterprise environment, where it can really be necessary. --- ## Post 104 by @3QVvxrhnYZ — 2023-09-07T05:28:22Z That’s right: phishing is the most common/one the most common attack vectors. But as I said, MDAG and disabling JIT is not an appropriate approach to deal with it for regular people and for general web-browsing. If we are talking about Edge, SmartScreen _already_ prevents you from accessing dangerous links in the first place. MDAG is of no use here. Except theoretically, we could set up MDAG so that it would _open_ dangerous links based on the list of dangerous websites fetched from SmartScreen, and so a curious user would be able to observe with awe how their isolated-virtualized environment gets infected. Then the user closes that tab which runs isolated, all the malware gets dropped, and the user goes on about their business, as if nothing happened. Or, we could just rely on using SmartScreen/Google Safe Browsing + some secure DNS, and they would prevent opening harmful links in the first place. In an enterprise environment, however, such measures wouldn’t not be very efficient, because this is a different threat model, and risks of compromise are much higher. Enterprises are very often under attacks. I think it’s quite necessary for an enterprise to set up Edge in MDAG mode. An admin makes a whitelist of trusted websites for their organization, and all other websites automatically run in an isolated environment, in a small sandbox — very neat. There were millions of cases when security-uneducated employees clicked phishing links in their emails. Then the whole company gets compromised very badly. MDAG could be really useful here. The difference, however, between phishing links for regular users and for an enterprise, is that attackers make a specifically crafted, very “personalized” phishing scheme for an employee or several employees of a company. And these have a much higher success rate of compromise than the usual, “all-inclusive” type of phishing. --- ## Post 105 by @3QVvxrhnYZ — 2023-09-07T05:43:04Z > [@3QVvxrhnYZ](#): > > For those who use other browsers (both Chromium and Gecko-based): most of the browsers fetch a list of dangerous websites from Google Safe Browsing. I forgot to mention that Safari as well uses Google Safe Browsing list. For those who set their region to China, It also uses a Chinese-specific counterpart of Google Safe Browsing —Tencent Safe Browsing. So basically all the browsers use Google Safe Browsing. --- ## Post 106 by @user1 — 2023-09-07T06:13:45Z I think this thread is derailing. Arguments like “how likely to be hacked vs privacy concerns” are meaningless because it depends on the threat model which varies greatly from person to person. It’s the Windows thread, if someone is all in for privacy concerns or attacking surface maybe is using the wrong operating system. There is good points on both side, let’s try to not see all in black or white. I hope the PG team will be able to finalize the windows guide section soon to sum up and address all these concerns. --- ## Post 107 by @Torsten — 2023-09-12T03:33:18Z I thought it was always downloading software or any executable file locally? --- ## Post 108 by @Torsten — 2023-09-12T03:43:21Z Again the same thing lots of people think. NoScript has features NO BROWSER has. You can disable and enable different Javascript types, and most importantly handle each origin differently. Only problem is, there is no “safe browsint JS list” I would use. May be worth maintaining one for Noscript? Using Noscript you can have actually working websites, but block every unnecessary JS thats simply useless and just tracking. Disabling Javascript breaks nearly all sites, its a useless feature nowadays. Its why Vanadium and other mobile browsers suck. Also it sometimes gives me XSS warnings, mostly when microsoft tries to access othee domains data I think. Everyone should use NoScript. --- ## Post 109 by @lepras — 2023-09-12T04:33:36Z I mean best way is probably by group policies and UAC. I remember a old-looking GUI that configures group policies for windows 10, I can’t seem to remember that. And I don’t see any mentions of these so here it goes: > **[GitHub - Sophia-Community/SophiApp: :zap: The most powerful open source tweaker on...](https://github.com/Sophia-Community/SophiApp)** > > :zap: The most powerful open source tweaker on GitHub for fine-tuning Windows 10 & Windows 11 > **[GitHub - safing/portmaster: 🏔 Love Freedom - ❌ Block Mass Surveillance](https://github.com/safing/portmaster)** > > 🏔 Love Freedom - ❌ Block Mass Surveillance > **[GitHub - TheWorldOfPC/Windows11-Debloat-Privacy-Guide](https://github.com/TheWorldOfPC/Windows11-Debloat-Privacy-Guide)** > > Contribute to TheWorldOfPC/Windows11-Debloat-Privacy-Guide development by creating an account on GitHub. > **[The Ultimate Windows Utility](https://christitus.com/windows-tool/)** > > Having Fun with Technology > **[WinDirStat](https://windirstat.net/)** > > Windows Directory Statistics [https://www.elevenforum.com/t/clean-install-windows-11.99/](https://www.elevenforum.com/t/clean-install-windows-11.99/) [https://www.elevenforum.com/t/custom-install-windows-11.13926/](https://www.elevenforum.com/t/custom-install-windows-11.13926/) [https://www.elevenforum.com/t/repair-install-windows-11-with-an-in-place-upgrade.418/](https://www.elevenforum.com/t/repair-install-windows-11-with-an-in-place-upgrade.418/) > **[Microsoft PowerToys - Windows Utilities for Power Users](https://learn.microsoft.com/en-us/windows/powertoys/)** > > Microsoft PowerToys includes 25+ free Windows utilities including FancyZones, PowerToys Run, Color Picker, PowerRename, and more. Boost productivity for power users on Windows 10/11. --- ## Post 110 by @sha123 — 2023-09-12T06:42:41Z > [@Torsten](#): > > How can you say any proprietary Software is secure if no neutral entity looked at their code? You don’t need source code to evaluate security, although it can be helpful. --- ## Post 111 by @sha123 — 2023-09-12T06:52:17Z > [@Torsten](#): > > You can disable and enable different Javascript types, and most importantly handle each origin differently. What do you do, if a website breaks without JS from some origin? Are you consequent enough to not just simply allow it to get it to work? Most people aren’t and even usually good origins can suddenly serve malicious content (e.g. CDNs). In my opinion that’s just cumbersome. Disabling JIT and using a browser with a good security architecture is way more suitable for everyday use. If you want to go a step further either confine with MAC (on Linux) or use a lightweight VM. --- ## Post 112 by @Torsten — 2023-09-13T22:40:32Z Yes having the browser run in a virtualized environment or simply a container may be helpful. But Noscript not only improves security (where I was never hacked since ditching Windows and shady executables) but also daily privacy breaches. --- ## Post 113 by @sha123 — 2023-09-14T08:28:27Z > [@Torsten](#): > > or simply a container may be helpful You can’t significantly improve security of a browser with a typical Linux container, because the browser’s own sandboxing already extensively uses this, better than you could with using it inside a container. --- ## Post 114 by @anon73250778 — 2023-09-15T10:43:52Z Sandbox escape mechanisms are starting to be a part of a exploits. In general, adding defensive layers that does not significant impact performance is desirable these days. --- ## Post 115 by @sha123 — 2023-09-15T11:15:46Z But not with a container. Use MAC or a VM. --- ## Post 116 by @cromagnonymous — 2023-09-18T03:07:05Z All this focus on sandboxing browsers - I thought modern browsers were pretty good at limiting malicious code? Even if you open a “dangerous link,” what’s the worst that an unsafe website could do? Start a file downloading? (which, if you have your browser set to always ask, is already mitigated.) I didn’t think browsers allow malicious websites to execute any code outside of the website’s own context, and certainly not to escape the browser and run cause problems on the system. Or am I mistaken, and viruses can actually tunnel straight from the DOM into my operating system, without even needing me to downlaod and run a file first? --- ## Post 117 by @ikelatomig — 2023-09-18T05:40:07Z > [@abstract](#): > > Furthermore, it adds the inconvenience of having to enter a password for each and every UAC prompt; which I think only the most patient users are actually willing to do (I personally don’t expect most people to be willing to enter a long and complex passphrase simply for opening Task Manager). I basically suggested it because I used my Fingerprint reader to allow the UAC prompt instead of entering password manually. --- ## Post 118 by @ikelatomig — 2023-09-18T05:44:53Z To be honest, there is a lot of messages, Since I lot checked this post. I would like to read and reply to them. But I switched from Windows to Fedora Workstation 38. Basically, I am a linux user. Missing few quirks which I could just adapt or find alternative ways here. I will read and reply on my free time. Will check the PR and update it sooner. Some pages are offline. I mean content is still on my PR but not as webpage. --- ## Post 119 by @sha123 — 2023-09-18T06:23:48Z > [@cromagnonymous](#): > > I thought modern browsers were pretty good at limiting malicious code? Depends. At least better than it was in the past. > [@cromagnonymous](#): > > I didn’t think browsers allow malicious websites to execute any code outside of the website’s own context, and certainly not to escape the browser and run cause problems on the system. Visiting malicious websites can lead to a full-system compromise including persistence. The browser’s security mechanisms just set the bar higher. You can only increase cost and effort for attackers. Security is nothing absolute and there will always be some way around the protections, especially in such huge complicated software written in memory-unsafe languages like browsers. --- ## Post 120 by @cromagnonymous — 2023-09-18T13:32:44Z > [@sha123](#): > > Visiting malicious websites can lead to a full-system compromise including persistence. The browser’s security mechanisms just set the bar higher. You can only increase cost and effort for attackers. Security is nothing absolute and there will always be some way around the protections, especially in such huge complicated software written in memory-unsafe languages like browsers. Damn. Guess I should grab my plastic shovel coz I’m going in the sandbox then --- ## Post 121 by @anon73250778 — 2023-09-19T07:43:45Z > [@cromagnonymous](#): > > viruses Viruses are an outdated concept from the 90s and early 2000s. General malware these days are an entirely different breed: The low effort ones are botnets seeking to "infect"and passively spread throughout the internet in the classical and enable DDoS-as-service. Then there is the more sophisticated SolarWinds-like attack where the bad actors implants themselves into a software supply chain and spread themselves into important places - its as if hackers implanted itself to WinRar and sends malevolent updates to your local WinRar. In the eyes of the OS and antivirus it is technically a correct version of WinRar because it came from the officially signed WinRar update server but its in fact a modified WinRar that can open a backdoor into tour network. --- ## Post 122 by @cromagnonymous — 2023-09-19T16:00:56Z > [@anon73250778](#): > > botnets seeking to "infect"and passively spread throughout the internet Oh. Thought that was kinda what the definition of ‘virus’ was. Anyway, I don’t want to get caught up on semantics. There are still cryptominers and ransomware to worry about, right? > [@anon73250778](#): > > In the eyes of the OS and antivirus it is technically a correct version of WinRar because it came from the officially signed WinRar update server but its in fact a modified WinRar that can open a backdoor So what in the world can we as individuals do to mitigate stuff like this, if 1. The OS won’t catch it, 2. An AV won’t catch it, and 3. Even savvy internet-safe user behavior won’t prevent it since it appears for all intents and purposes like a normal software update? Even if I used sandboxie to isolate the majority of apps (which I plan to), I would never think go sandbox something like winrar, per your example… --- ## Post 123 by @lovfi — 2023-09-20T01:34:10Z I haven’t been following this thread, but I think it should encompass my question, so I thought I’d ask here instead of creating an unnecessary new topic. Is there a general resource an average user can follow to configure and actively maintain a relatively private windows desktop? As of right now, outside of general good practice and only using software that doesn’t violate my threat model, I plan on using Portmaster as a firewall and telemetry blocker, and have considered running [https://privacy.sexy/](https://privacy.sexy/). Is there anymore I should be doing? --- ## Post 124 by @Dkama — 2023-09-22T03:45:19Z Privacy and security on Windows are so bad that there seems to be very little that people agree on. On the top of this discussion you can find a link to ikel’s guide, so there’s that. Also, in the guide there’s a way to disable telemetry via group policies. This is only available in Enterprise and Education versions. You can download Windows Enterprise in Microsoft’s site (Evaluation something is what the page is called - it asks an email but accepts anything), and you’ll have to use Microsoft Activation Script from massgravel’s github. It’s up to you if the risks are worth it. On there you’ll also see a recommendation to only install software from the Store, since that’s the only way to run software in a sandbox. MS now requires a MS account to use the Store, so to get more security you need to get a MS account, link it to your OS and create some holes in your firewall/DNS block to allow it to talk back to the mothership. So, to get more security, you need to get less security. And a lot less privacy. It’s up to you. (if you have a lot of wrong opinions, trusting Microsoft/Apple/Google/etc is increasingly a security issue on top of a privacy one, but a lot of people - PG included - don’t seem to consider this in any threat model) You can also set up NextDNS on your router and enable their Windows telemetry list, just in case. Also, search digitalblossom in github. They have some scripts that add a bunch of urls and ips to the firewall and to the hosts file. Yes, it’s badness enumeration, but what do you have to lose? I tested then in a VM and they didn’t seem to break anything. For Win10, but MS telemetry urls probably didn’t change much in 11. Edit : download anything you need to a USB drive, software, scripts, Mullvad Browser, VPN software, etc, format your hd and reinstall windows without internet and without creating a MS account. Install everything before turning internet on. That’s all I can remember. --- ## Post 125 by @cromagnonymous — 2023-09-22T19:16:31Z > [@Dkama](#): > > Also, search digitalblossom in github. They have some scripts that add a bunch of urls and ips to the firewall and to the hosts file. I looked through digitalblossom’s repos and didn’t see anything to that effect. Is there a specific repo you can link to? --- ## Post 126 by @Dkama — 2023-09-23T01:35:25Z Ok, that was not it, sorry. Try supmaxi. There’s block-telemetry.ps1 and Make\_windows10\_great\_again.bat (which has a lot of other stuff that I wouldn’t run). Those lists are over 5 years old and probably out of date. Would need to run some Wireshark to find missing domains/IPs. They probably also break a lot of stuff like Windows Update, so you’d have to find what to allow. So, all in all, there’s probably a LOT of work involved. Then, even if you succeed, you’ll still be praying your OS don’t send Microsoft/NSA information using Windows Update’s IPs. --- ## Post 127 by @3QVvxrhnYZ — 2023-09-25T19:23:17Z > Using Noscript you can have actually working websites, but block every unnecessary JS thats simply useless and just tracking. If you want to block bad .js stuff — Brave’s integrated adblocker or uBlock Origin already do that, and it requires _zero_ user input or fiddling whatsoever. Brave’s adblocker already blocks tracking and other junky .js scripts, and uBlock Origin blocks them too. This is really enough. There’s no point in enumerating badness. I know that some frenzied users pile up such extensions as Decentraleyes, uMatrix (which is abandoned), user agent rotator, CanvasBlocker, and so on. This is a very wrong approach to privacy, it actually does the opposite. Moreover, NoScript is redundant and is a big hassle to use for the majority, and will decrease people’s UX heavily. A regular user doesn’t understand JavaScript and doesn’t need it either, hence they won’t benefit from using NoScript. All my comments on this forum appeal to regular people; if one has an elevated threat model, then this is a completely different talk. PrivacyGuides itself mainly focuses and appeals to regular people, and a little bit on people with an elevated threat model, but only indirectly. And if you have found a use for NoScript and consider it useful — good, use it. But this is not an extension regular people should use or need, so no need to proselytize. Sorry if I sound rude or something else — I didn’t mean to! I just say that you shouldn’t recommend using such a technical, as well as redundant extension as NoScript to everyone. > Only problem is, there is no “safe browsint JS list” I would use. It’s illogical/incorrect. There’s absolutely no need to make a whitelist of “good” .js scripts. It should be the other way around: to maintain a blocklist of “bad” .js scripts. As I said, Brave’s adblocker and uBlock Origin already maintain such a list and block “bad” .js stuff. Use Brave browser or uBlock Origin and don’t waste your precious time with NoScript. I agree with PrivacyGuides’ recommendation of extensions — uBlock Origin is the only extension the majority might need. My another personal recommendation is [Dark Reader](https://darkreader.org), if one prefers dark mode for everything. Nowadays, a lack of dark mode on websites must be illegal x). It causes eyestrain and dry eyes. Some security-hypersaturated people here go as far as advising regular people to disable JIT in their browser, being completely oblivious as to what category of people might ever need to disable JIT (spoiler: it’s not for regular people at all), and in what circumstances that category of people might need to do so. Those who give such advice — really go to hilarious extremes with such myopic vision. Like, let’s advise casual folks to use Qubes OS on an air-gapped PC, wrapped in a faraday bag. > Everyone should use NoScript. I would re-phrase it in this way: “Most people would benefit from using uBlock Origin”. Recommending NoScript to _everyone_ is a similar case. It implies being oblivious to how most people use their PC, and projecting one’s own level of knowledge/needs/use-case onto the others. You think they will tinker with NoScript? No, they don’t and won’t understand what JavaScript is, in the first place. NoScript is _not_ for regular people and they simply don’t need it. If you are an advanced user and have found a use for this extension — that’s good, use it, but don’t evangelize it to hundreds of regular, non-techy people who view these threads to gain information and learn. We need to educate the majority; we need to kickstart their privacy/security journey — _this_ should be our focus. Lots of techy people (who are a minority) are into privacy/security for a long time already. Some people don’t know that other browsers besides Chrome exist, and here we are talking about NoScript and disabling JIT… People really shouldn’t project their use-case or threat model onto other people. We should start with the basics of privacy/security, and from there we should give individual recommendations to users who ask a specific question on a forum, recommendations which are based on that user’s threat model/use-case. For the majority, we should find that sweet spot — a balance between privacy/security and convenience/user-friendliness. We shouldn’t “go all in” regarding privacy/security. We shouldn’t recommend extreme measures to someone who doesn’t need them at all. --- ## Post 128 by @3QVvxrhnYZ — 2023-09-25T19:28:28Z I advise people to listen to people who are knowledgeable in the privacy/security sphere and to stick to their recommendations, these people are, for example: PrivacyGuides’s team lead Jonah Aragorn; GrapheneOS team; TOR team, arkenfox user.js developer, and some others. Smart people have already done a lot of the work and research, and figured out lots of things. Most people just need to stick to their recommendations. For people with an elevated threat model, or for people with some specific needs or use-case, recommendations to them can be adjusted and their case should be treated individually. PrivacyGuides already has a very user-friendly, visually appealing website with sane, unbiased, not opinionated, with no ideological fanaticism, privacy/security-radicalism or extremism, alarmism, fearmongering, baseless FUD, or else, which is unfortunately very common among privacy/security enthusiasts, and can often be seen on various forums and websites. People should do their own research and make informed decisions, I mean _very_ well-informed, with information taken from sane, knowledgeable and trustworthy people. Unfortunately, some impressible people instantly give in to/fall for FUD (or whatever information they consume) with no second thought. For example: they just watch The Hated One’s bullsh\*\* video about Signal, take it for granted, and go on crusades all over the internet, spreading FUD about Signal and advising people against using it. I noticed that many people don’t think at all, don’t self-research – they just wait for someone else to put information into their brain, no matter whether the info is correct and no matter _anything_ about that info in general, and then they automatically agree with that information. There are a lot of YouTube channels and websites spreading similar FUD, maybe for clout, maybe to seem smart, and there is a lot of severe tribalism, circlejerking and echo-chambering in privacy/security communities. It can be really difficult for most people to filter out bad stuff, especially those who began their privacy/security journey only recently. I think it is one of the reasons why PrivacyGuides exist – to fix all the bullsh\*\* out there, and I hope it won’t change for the worse over time, and stays like that forever. I have always really liked Jonah’s neutral, unbiased, impartial, “clean” approach/take on everything. He set the right approach and foundation for the PrivacyGuides project. This is what this website needs to be, even a little “detached”: looking at everything from aside, no prejudice and bias towards anything, the “compass” stays still. --- ## Post 129 by @3QVvxrhnYZ — 2023-09-25T20:14:00Z > and have considered running [https://privacy.sexy/](https://privacy.sexy/) I advise you to be _very_ careful with it. It is extremely simple to break something with such tools — been there, done that. I and some other people I spoke to, who have been testing/trying all sorts of such third-party tools/tweakers, eventually came to a conclusion that such third-party tools are simply redundant, unreliable, “dirty” and only cause troubles and breakages in the long run. My personal advice to configure privacy/security of Windows is via Group Policy Editor (gpedit.msc). That’s all. It’s a native and “clean” way of configuring Windows. However, be careful when configuring it: if you are unsure what this or that policy does — don’t touch it! You can break the system. GPO is for technically-inclined users. It can take some time to familiarize yourself with GPO when you configure it for the first time, but when you are done configuring, you can just export your GPO configuration and save it for the next install or for another PC. Also, you will find a lot of crucial security-related features in GPO, which no third-party tweaker is able to configure. For example: [Allow administrator account lockout](https://support.microsoft.com/en-gb/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00) [Account lockout threshold](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-threshold) [Account lockout duration](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-duration) [Reset account lockout counter after](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after) People who don’t want or can’t configure GPO for whatever reason (laziness; don’t want to waste time; not techy and don’t understand GPO; afraid to break the system by configuring something incorrectly) — should simply configure their Windows via Settings and Control Panel. Thinking that using third-party “privacy-tweakers” is going to significantly increase your privacy in your Windows install is wishful thinking. No third-party tool is going to give you a significant level of privacy on Windows, unless you just block the internet access altogether. If you want true and real privacy, and having real privacy is your purpose/use-case — don’t use Windows, use Linux (and _even then_ you have to pick a distro which most likely won’t shove telemetry into itself / which most likely won’t succumb to enshittification at some point of time in the future — not Ubuntu, that is). Using third-party “privacy-tweakers” does more harm than good in the long term of using your Windows install. If one is using Windows, they should come to terms with and peacefully, [buddhistically](https://en.wikipedia.org/wiki/Th%C3%ADch_Qu%E1%BA%A3ng_%C4%90%E1%BB%A9c#Day_of_the_act) accept the fact that they will never be significantly private when using it, and they should stop bothering with third-party “privacy-tweakers”. Also, regarding security, you can find a lot of useful information here: > **[Windows security documentation](https://learn.microsoft.com/en-us/windows/security/)** > > Windows is designed with zero-trust principles at its core, offering powerful security from chip to cloud. As organizations embrace hybrid work environments, the need for robust security solutions becomes paramount. Windows integrates advanced... And don’t hesitate to search up the internet for info on something from the official documentation, if something from the documentation is too technical or is written in a manner too difficult to get a grasp of. Oftentimes, random websites on the internet have a much user-friendlier/simplified explanation of some aspect of Windows, in comparison to the official Microsoft’s documentation, which appeals more to enterprise system administrators, as it seems to me. > [@Dkama](#): > > security on Windows are so bad Window’s security is decent, and has improved dramatically in recent years. What is “so bad” — it is Linux’s security. Proprietary operating systems will always be more secure than open-source ones, but will never be as private as open-source ones. I also fully agree with Joanna Rutkowska on that: > So, I’m reinforced in my belief that _security_ of mainstream platforms (from Apple, Google, MS) will continue to improve, likely exceeding the “open source” offerings. But, the open source will still have an edge in: > > 1. trustworthiness/auditability > 2. customization freedom Original post: [https://twitter.com/rootkovska/status/1136220742662664193](https://twitter.com/rootkovska/status/1136220742662664193) > [@Dkama](#): > > MS now requires a MS account to use the Store This is factually false. You can use a local account (on both Windows 10 and 11) and use Microsoft Store freely. However, you will be unable to install paid apps or apps that have an age rating that requires verification, such as Spotify or Netflix. I’ve used both Windows 10 and 11 with a local account and I was (and am) using Microsoft Store freely. I don’t use paid apps or apps with an age rating, so I have zero issues in _my_ use-case. It’s completely feasible to use Windows 11 and take a full (for the most part. Like, 90%) advantage of it without making a Microsoft account. > [@Dkama](#): > > Yes, it’s badness enumeration, but what do you have to lose? You lose stability and reliability of your system, especially in the long run. Testing something in a VM doesn’t count. What counts is using your bare-metal Windows install for a long time and subjecting it to “wear and tear” naturally. And only then you should see if > [@Dkama](#): > > scripts that add a bunch of urls and ips to the firewall and to the hosts file affect the stability of your install. > [@Dkama](#): > > Try supmaxi. I don’t know why you recommend using unmaintained, outdated Windows telemetry blocklist dug out from the deep depths of GitHub, from some random no-name author (no offense to them, they just don’t have any credibility) which hasn’t even visited GitHub in a _long_ time, all the while when there are several popular and maintained options from credible, reputable authors. I won’t list them because I don’t recommend _anyone_ using this approach of blocking telemetry: via third-party tools/tweakers/blocklists. --- ## Post 130 by @sha123 — 2023-09-26T15:04:45Z > [@3QVvxrhnYZ](#): > > Some security-hypersaturated people here go as far as advising regular people to disable JIT in their browser, being completely oblivious as to what category of people might ever need to disable JIT (spoiler: it’s not for regular people at all), and in what circumstances that category of people might need to do so. JS exploits are quite common and JIT is responsible for about half of them. It’s a common misconception to think that you need to be a high value target, to get hit by it. Disabling JIT has only little impact on the usability of everyday browsing. Only very few websites heavily rely on it and if you know that, you can selectively enable it for these. It’s very reasonable to disable it and you get a massive security boost with little downsides. --- ## Post 131 by @3QVvxrhnYZ — 2023-09-26T15:35:15Z As I said [here:](https://discuss.privacyguides.net/t/windows-guide/250/103) > [@3QVvxrhnYZ](#): > > disabling JIT, which heavily slows down browser’s performance (especially on Android, as per my tests)? The most annoying aspect of disabling JIT for most people would be the page loading delay. Or, simply put: with JIT disabled, users will have to wait much more until their page gets rendered. Disabling JIT slows down browsing, especially on lower-end devices. Benchmark it for yourself. If you don’t trust me, you can listen to a reputable source — @SkewedZeppelin: > [@Vanadium (GrapheneOS Web Browser)](https://discuss.privacyguides.net/t/vanadium-grapheneos-web-browser/12828/30): > > Why are you implying I am insulting you? The only thing disabled JIT will do is cause JavaScript to run slower and WASM to be disabled, it will not block ads. (Microsoft is supposedly trying to upstream a patchset that lets WASM run when JIT is off.) Also: > Page Load times show the most severe decrease with tests that show regressions averaging around 17% > Disabling JIT does result in significantly lower scores in JavaScript benchmarks. Our tests showed a decline as high as 58%. Source: [Super Duper Secure Mode | Microsoft Browser Vulnerability Research](https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/) > Since JIT-less mode disables the optimizing compiler, it comes with a performance penalty. We looked at a variety of benchmarks to better understand how V8’s performance characteristics change. Speedometer 2.0 is intended to represent a typical web application; the Web Tooling Benchmark includes a set of common JS developer tools; and we also include a benchmark that simulates a browsing workflow on the Living Room YouTube app. All measurements were made locally on an x64 Linux desktop over 5 runs. > Speedometer 2.0 is around 40% slower in JIT-less mode. Roughly half of the regression can be attributed to the disabled optimizing compiler. The other half is caused by the regular expression interpreter, which was originally intended as a debugging aid, and will see performance improvements in the future. > The Web Tooling Benchmark tends to spend more time in TurboFan-optimized code and thus shows a larger regression of 80% when JIT-less mode is enabled. > Finally, we measured a simulated browsing session on the Living Room YouTube app which includes both video playback and menu navigation. Here, JIT-less mode is roughly on-par and only shows a 6% slowdown in JS execution compared to a standard V8 configuration. This benchmark demonstrates how peak optimized code performance is not always correlated to real-world performance, and in many situations embedders can maintain reasonable performance even in JIT-less mode. > Memory consumption only changed slightly, with a median of 1.7% decrease of V8’s heap size for loading a representative set of websites. Source: [JIT-less V8 · V8](https://v8.dev/blog/jitless#results) > [@sha123](#): > > It’s very reasonable to disable it and you get a massive security boost with little downsides. Whether you need to disable JIT completely depends on your use-case/threat model. There _are_ downsides. Browsing with JIT disabled is _really_ not ready for general usage by everyone, yet, and it _shouldn’t_ be recommended to _everyone_. > [@sha123](#): > > It’s a common misconception to think that you need to be a high value target I didn’t imply that. I implied that regular people getting pwned by JIT exploits is a rare case. --- ## Post 132 by @sha123 — 2023-09-26T16:25:47Z You obviously have never used a JIT-less browser for everyday use. The performance impact is negligible for the vast majority of websites, even on low-powered devices. I have used JIT-less for years on multiple devices, including some low-powered ones without negatively noticing it. --- ## Post 133 by @3QVvxrhnYZ — 2023-09-26T16:32:46Z > [@sha123](#): > > You obviously have never used a JIT-less browser for everyday use. Oh I did, I did. > [@sha123](#): > > including some low-powered ones Desktop or Android? Care to share your specs? I can literally record a video specifically for you from my low-end Android, where I can demonstrate the difference in page loading delay with JIT enabled and disabled. The difference is very noticeable visually. --- ## Post 134 by @anon28734771 — 2023-09-26T17:51:44Z I’m daily driving Vanadium with JIT disabled for almost a year, and I have zeeeerooooo complaints. But that’s probably because all the sites that I visit aren’t pieces of crap. Most of them work without JS, and the ones that need JS work well without JIT. Never have I ever encountered a site that would depend on JIT so much that it would impact my experience. --- ## Post 135 by @3QVvxrhnYZ — 2023-09-26T18:42:04Z Would you call [google.com](http://google.com) a piece of crap, for example? I give the most banal example: on my device, [google.com](http://google.com) loads longer with JIT disabled, than when it’s enabled. If someone has doubts, I can prove it by recording a video. If you have a mid-tier device, the difference in performance might not be noticeable. Google Pixels are all good, even the first one. Most likely you don’t see the difference due to having good specs. Nice job flagging my comment by the way. --- ## Post 136 by @anon28734771 — 2023-09-26T18:48:50Z > [@3QVvxrhnYZ](#): > > Would you call [google.com](http://google.com) a piece of crap, for example? Yes. I use Brave Search, which works amazingly without JavaScript, not only without JIT. --- ## Post 137 by @anon28734771 — 2023-09-26T18:52:29Z > [@3QVvxrhnYZ](#): > > I give the most banal example: on my device, [google.com](http://google.com) loads longer with JIT disabled, than when it’s enabled. If someone has doubts, I can prove it by recording a video. If you have a mid-tier device, the difference in performance might not be noticeable. Google Pixels are all good, even the first one. Most likely you don’t see the difference due to having good specs. I have a feeling that your phone is so old that you’re sacrificing your privacy and security because it doesn’t even receive updates anymore. I would suggest upgrading if you have the means. > [@3QVvxrhnYZ](#): > > Nice job flagging my comment by the way. I didn’t flag a single comment on this topic. I hope that someone from [@team](/groups/team) can confirm that to you. Don’t like to be accused of something that I didn’t do. --- ## Post 138 by @3QVvxrhnYZ — 2023-09-26T19:05:40Z > [@anon28734771](#): > > I have a feeling that your phone is so old Yeah it is, it’s very old. But I’m not in the minority, half of my family uses crappy phones too, and I know some other people in my area with old phones too. Unfortunately neither of us have the means of upgrading. My circumstances are awful and I live in a place where there’s a war happening. Hence I can conclude that recommending disabling JIT for everyone isn’t a solution, yet. I think all three of us can reach a compromise on that JIT topic and say that disabling JIT can only apply to those who have at least a mid-tier device. > [@anon28734771](#): > > I didn’t flag a single comment on this topic. Answered in another thread. > [@anon28734771](#): > > you’re sacrificing your privacy and security No, I wouldn’t use a browser with JIT disabled even if my device allowed me to use it without sacrificing usability and performance. I would disable JIT only if there were 100% no drawbacks and performance regressions. I know what JIT is, know the effects of disabling/enabling it, and I know _for myself_ whether I need to disable JIT or not. I don’t sacrifice my security because I’m sure I won’t get exploited by a JIT-related vulnerability. But as we can infer from this thread, everyone has their own priorities, use-cases, ideas and even seemingly “entrenched” ideologies, etc. It’s everyone’s own business I guess. --- ## Post 139 by @3QVvxrhnYZ — 2023-09-26T20:14:00Z > [@anon28734771](#): > > Yes. I use Brave Search, which works amazingly without JavaScript, not only without JIT. I’ve just tested it. Same story with Brave Search: the effect of disabling JIT compilation is visually noticeable. Same page loading delay. So it’s an issue related to a low-end device, not Google’s fault. I would also certainly not call Google Search website crap. For your information, Google Search works amazingly without JavaScript too. But, well, as always — to each his own. :victory_hand:t2: --- ## Post 140 by @abstract — 2023-09-29T07:55:39Z I wanted to base my statements on official Microsoft documentation. I haven’t argued for not using a local account. The technical documentation is largely targeted at enterprises, not end-users. In corporate environments it makes sense to hand out privileged access only to a limited set of employees. > [@3QVvxrhnYZ](#): > > Local accounts don’t need to enter any passwords to access Task Manager. That is: Local accounts don’t have to have Administrator privileges to access Task Manager. With UAC set to highest, the default way of opening Windows Task Manager will show the user a UAC prompt. You may of course adjust this through group policy, or lower the UAC security level. Perhaps by “local account” you mean a (in Windows’s terms) “standard user” account? --- ## Post 141 by @sha123 — 2023-09-29T10:32:06Z > [@3QVvxrhnYZ](#): > > Care to share your specs? Some old devices I have laying around: Samsung Galaxy S8, a Lenovo Laptop with a core i3 dual core and 4GB RAM and a Google Pixel 4a5G. I would consider the former two to be pretty low-powered in today’s terms. --- ## Post 142 by @3QVvxrhnYZ — 2023-09-30T16:57:41Z > [@abstract](#): > > The technical documentation is largely targeted at enterprises, not end-users. Yeah I noticed that. That’s why I advised people on searching up something from the documentation on the internet. > [@abstract](#): > > With UAC set to highest, the default way of opening Windows Task Manager will show the user a UAC prompt. No, I’m on Windows 10 now, and opening Task Manager doesn’t invoke a UAC prompt. UAC is on highest. > [@abstract](#): > > Perhaps by “local account” you mean a (in Windows’s terms) “standard user” account? Yes-yes. But opening Task Manager doesn’t do invoke a UAC, no matter if you are on a Standard User account, or on an Administrator account. That’s the default behavior. --- ## Post 143 by @3QVvxrhnYZ — 2023-09-30T17:18:01Z Okay I see. My standards are lower because the standard of living in my area is extremely low. I guess, from my low-standard point of view, I would call Google Pixel 4a a mid-tier device. My phone is worse than either Samsung Galaxy S8 or Google Pixel 4a. However I’m not in the minority, as I said. So it’s kinda early to recommend everyone to disable JIT, in my opinion. You said that the performance impact is negligible, but it still does have an impact. It could be even as little as 100 or 50 milliseconds. And if you sum up all those 50 milliseconds of all the times when you loaded a page — it would amount to a big number eventually. It is sacrificing UX/performance for that tiny chance of being JIT-exploited. I think it’s better to wait until the technology improves (both software and hardware), and until _all_ people in the world will run no less than phones with specs similar to those of Google Pixel 3, for example. Then we can recommend disabling JIT to everyone. Can you also point me to any sources that say that JIT exploits are common? If I’m not right in my opinion that a regular user getting exploited by a JIT-related vulnerability is a rare case, you can prove me wrong by linking some info. --- ## Post 144 by @jonah — 2023-11-21T08:26:04Z > [@ikelatomig](#): > > I loved doing and working on this PR and did a lot of research and wrote everything on my own personal experience. But the approval and many help **I** expected were disappointment. > > I have been a windows user. I still am. But I am unsure about my guide. > > So, It is to say that I am no longer working on this PR. This discussion and PR will be open though. I would work on further if there is attention and discussion with people and from PG team. :pray: Thank you for your work on this! I’m sorry we haven’t been able to review this PR… I just want to let you know that I’m going to be working on completing this guide for the next website release by the end of the year. The work you’ve done is really appreciated even though it’s taken us a long time to get to it, and you’ll be credited in the final draft :slight_smile: --- ## Post 145 by @jonah — 2023-11-21T08:26:23Z --- ## Post 146 by @anon28734771 — 2023-11-21T08:31:45Z Don’t forget to mention how based EU and EU Windows is. It actually became usable, which is a lot to say about Windows. We should probably recommend that people choose one of the EU countries when choosing a region for Windows. --- ## Post 147 by @deviancy — 2023-11-21T16:11:03Z Idk that I’d called it based. It just moved in the direction of less shit. Wonder if merely changing a VPN server to be in the EU will be enough to download their version when it gets to public release. --- ## Post 148 by @Sprout3425 — 2023-12-25T13:31:36Z Respectfully, is anyone able to answer [my questions](https://discuss.privacyguides.net/t/hardening-windows/15750) in regards to this guide? --- ## Post 149 by @anon34108895 — 2023-12-28T06:55:20Z IMO Microsoft Surface for business should be recommended over other WIndows PC because it has 6 years firmware support, is secured-core certified and has open sourced UEFI. There’s no privacy without security and you cannot use Windows privately on Lenovo X230 (jk Also, pls donot forget to mention win32 app isolation. --- ## Post 150 by @user1 — 2023-12-28T08:16:30Z I think Dell has a similar support policy, around 5-6 years too. --- ## Post 151 by @sha123 — 2023-12-28T13:34:47Z > [@anon34108895](#): > > IMO Microsoft Surface for business should be recommended over other WIndows PC because it has 6 years firmware support, is secured-core certified and has open sourced UEFI. Do you have a source for these? Afaik most Microsoft Surfaces are not secured-core and I remember the firmware support to be shorter, but maybe this has changed since then. > [@anon34108895](#): > > win32 app isolation Isnt’t this only in public preview and barely used? --- ## Post 152 by @anon34108895 — 2023-12-28T14:40:22Z [6 years support](https://learn.microsoft.com/en-us/surface/surface-driver-firmware-lifecycle-support#surface-driver-and-firmware-support-lifecycle-policy) [secured-core for surface **FOR BUSINESS**](https://blogs.windows.com/devices/2023/10/25/microsoft-surface-security-keeping-you-protected/) (no,surface for consumers aka surface is not secured core) [Project mu](https://blogs.windows.com/windowsdeveloper/2018/12/19/%E2%80%AFintroducing-project-mu/) --- ## Post 153 by @anon34108895 — 2023-12-28T14:42:26Z yes but when win32 app isolation is out of preview it’ll be a **HUGE** security feature as you can isolate nearly every win32 app by yourself. I donot know if you can isolate every traditional app on Linux. afaik for macOS, the only thing you can do to improve app sandbox is to only install apps from mac App Store(or use some deprecated sandbox-exec command). --- ## Post 154 by @anon34108895 — 2023-12-29T01:47:24Z > [@'Hardening' Windows](https://discuss.privacyguides.net/t/hardening-windows/15750/13): > > imo if you’re short of time, at least you should read [complete privacy settings for Windows](https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) , [security baseline for Microsoft products](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines#where-can-i-get-the-security-baselinesm-components-to-microsoft-services) , [privacy settings for Edge](https://learn.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/) , [privacy settings for Office](https://learn.microsoft.com/en-us/deployoffice/privacy/manage-privacy-controls) this answer of mine may be helpful too --- ## Post 155 by @exaCORE — 2023-12-29T02:09:45Z I think you can. Im still not sure on the specifics (see my question on [this topic](https://discuss.privacyguides.net/t/linux-security-question-apparmor-and-sandboxing/15880)), but it can be done with some combination of firejail, bubblewrap, and/or Apparmor. --- ## Post 156 by @anon34108895 — 2023-12-29T02:19:36Z after some search I cannot find any related claim made by Dell, HP or Lenovo --- ## Post 157 by @anon34108895 — 2023-12-29T07:13:00Z There are some additional suggestions. Currently I donot have a github account so I cannot submit a pr. 1. use a [secured-core](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) devices with timely firmware support. my personal reccomendation is [surface for business](https://www.microsoft.com/en-us/surface/business) series. 2. turn on [Smart App Control](https://support.microsoft.com/en-au/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003). if you have privacy concerns, skip this and use [WDAC](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard) instead. 3. [configure](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/configure?tabs=common) Bitlocker to use TPM+PIN, long PIN length and 256 bit encryption 4. [Disable](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-microsoft-accounts#restrict-the-use-of-microsoft-accounts) Microsoft account 5. only update drivers through Windows Update or official websites. avoid softwares like Geforce Now 6. [do not show](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) username on lock screen 7. use [yubikey](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide) as local account 2FA method 8. turn off these telemetry.[1](https://learn.microsoft.com/en-us/dotnet/core/tools/telemetry#how-to-opt-out) [2](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry?view=powershell-7.4#:~:text=To%20opt%2Dout%20of%20this%20telemetry%2C%20set%20the%20environment%20variable%20%24env%3APOWERSHELL_TELEMETRY_OPTOUT%20to%20true%2C%20yes%2C%20or%201.) [3](https://learn.microsoft.com/en-us/microsoft-edge/webdriver-chromium/?tabs=c-sharp#opt-out-of-diagnostic-data-collection) 9. enable [complete mitigations](https://support.microsoft.com/en-us/topic/kb4073119-windows-client-guidance-for-it-pros-to-protect-against-silicon-based-microarchitectural-and-speculative-execution-side-channel-vulnerabilities-35820a8a-ae13-1299-88cc-357f104f5b11#:~:text=that%20are%20running.-,Registry%20settings,-We%20provide%C2%A0the) for side channel attacks. also [this](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/cve-2017-5715-and-hyper-v-vms#ensure-hyper-v-is-configured-to-expose-new-processor-capabilities-to-guest-virtual-machines) 10. these settings to improve security. [1](https://www.microsoft.com/en-us/security/blog/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/#:~:text=How%20to%20enable%20sandboxing%20for%20Windows%20Defender%20Antivirus%20today) [2](https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#enforce-local-account-restrictions-for-remote-access) [3](https://learn.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard?tabs=gpo#enable-delegation-of-nonexportable-credentials-on-the-remote-hosts) [4](https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN#suggested-actions) [5](https://support.microsoft.com/en-us/topic/kb5032314-how-to-manage-the-ole-object-conversion-vulnerability-associated-with-cve-2023-36563-98d95ae9-2f9e-4f65-9231-46363c31cf07#:~:text=If%20you%20have%20applications%20in%20your%20environment%20that%20are%20at%20risk%20of%20this%20vulnerability%2C%20follow%20these%20steps%20to%20mitigate%20the%20vulnerability) --- ## Post 158 by @anon34108895 — 2023-12-29T07:53:08Z As a Windows user I totally agree that it needs a lot of time and effort to harden Windows and make it more private. If you take a look into Microsoft Security Baseline, there are hundreds of recommended policies. Also different people have different threat models and choices, especially Windows Defender. But I also hope that this Windows Guide can be finished asap. --- ## Post 159 by @sha123 — 2023-12-29T08:42:32Z In general I would recommend to split security and privacy recommendations for Windows into different parts, also for important software like MS Office, otherwise it will just get overwhelming. Only recommend security measures which don’t compromise too much on privacy, because Microsoft has a tendency on implementing (security and other) features in the most privacy invasive ways. > [@anon34108895](#): > > turn on [Smart App Control](https://support.microsoft.com/en-au/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003). if you have privacy concerns, skip this and use [WDAC](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard) instead. Doesn’t SAC require optional diagnostic data to be turned on in Windows? > [@anon34108895](#): > > use a [secured-core](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) devices with timely firmware support. my personal reccomendation is [surface for business](https://www.microsoft.com/en-us/surface/business) series. While these are good recommendations for someone who wants to buy a new device and has the money to to get these expensive devices, I think it is important for the reader to get a feeling about which recommendations are important and which are not as much. For example I would consider using WDAC on Windows, activating all VBS features and attack surface rules for often exploited applications like MS Office as much more important for most users than getting a business surface and a lot more cost-effective. --- ## Post 160 by @anon34108895 — 2023-12-29T10:05:01Z After manually turning SAC on, you can turn telemetry off. --- ## Post 161 by @sha123 — 2023-12-29T10:42:52Z I read that SAC will still send information to MS even with diagnostic data set to the lowest level, so the question is whether the privacy implications are worth the additional protections for people who can’t deal with WDAC? --- ## Post 162 by @anon34108895 — 2023-12-29T10:45:53Z Btw you need to download [Edge](https://www.microsoft.com/en-us/edge/business/download?ch=1&form=MA13FJ) policy and [office](https://www.microsoft.com/en-sa/download/details.aspx?id=49030) policy firstly before applying security baseline. Also remember to update them often. You can follow this [rss](https://techcommunity.microsoft.com/gxcuf89792/rss/board?board.id=Microsoft-Security-Baselines) feed. --- ## Post 163 by @anon34108895 — 2023-12-29T10:52:29Z You are taking about [This](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph). I’m on my phone rn maybe we can discuss that later --- ## Post 164 by @anon34108895 — 2023-12-29T12:11:07Z In short I think it’s worth it. because the alt to this is using WDAC to whitelist every exectuables that are 100% secure. too complicated. You can also choose to not use SAC and windows defender at all. You just deny all exectuables from running in your host machine(using WDAC) and run every executables in sandbox which is also inconvenient. the less secure alt is to use virustotal to scan every exectuables before running or to use Windows Defender. lame choice for me. DO NOT count on yourself to determine what can be executed on your host Windows machine. --- ## Post 165 by @Sprout3425 — 2024-01-01T12:34:49Z Is there anyway to turn on **Smart App Control** without reinstalling Windows? --- ## Post 166 by @Sprout3425 — 2024-01-01T13:30:37Z Are these settings covered in the Windows Security Baseline? Also, how on Earth do you set environmental variables? --- ## Post 167 by @anon97654407 — 2024-01-01T14:38:22Z No, there’s no way of doing that. Microsoft actually explains why : > **[Smart App Control Frequently Asked Questions - Microsoft Support](https://support.microsoft.com/en-au/windows/smart-app-control-frequently-asked-questions-285ea03d-fa88-4d56-882e-6698afdb7003)** > > Frequently asked questions (FAQs) about Smart App Control, a Windows feature designed to block malicious, untrusted, or potentially unwanted apps from running on your device. > In order to ensure a more secure experience, we only enable Smart App Control on clean installs of Microsoft Windows 11. We want to be sure that there aren’t already untrusted apps running on the device when we turn Smart App Control on. --- ## Post 168 by @sha123 — 2024-01-01T15:01:18Z > [@Sprout3425](#): > > Is there anyway to turn on **Smart App Control** without reinstalling Windows? No. But you can create a WDAC policy with ISG turned on, which activates the main feature of SAC. That’s also helpful if you need to make something run which doesn’t work with ISG and you need an exception. --- ## Post 169 by @anon34108895 — 2024-01-02T01:54:51Z [Signed and Reputable Mode](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-create-base-policy#:~:text=Microsoft%2Dsigned%20software-,Signed%20and%20Reputable%20Mode,-Signed%20and%20Reputable) in [WDAC wizard](https://webapp-wdac-wizard.azurewebsites.net/) is basiclly SAC. this does not require a clean install. If you decide to do a clean install, remember to select your region to EU(to uninstall Edge and Bing) and accept optional diagsnotic data(to turn on SAC) during the out-of-box-experience. I also recommend to use a Enterprise edition so there is a UI option in OOBE to skip Microsoft account. After creating WDAC files using the wizard, you can apply it to your pc using [scripts](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-with-script). If you are not sure if it’s suitable for you, use audit mode. SAC and default Signed and Reputable Mode is suitable for normal users imo. --- ## Post 170 by @anon34108895 — 2024-01-02T02:13:20Z If you are a developer, if you wanna use WSL, WMIC, do [not](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac#:~:text=wscript.exe-,wsl.exe,-wslconfig.exe) use SAC. --- ## Post 171 by @sha123 — 2024-01-02T08:29:13Z The main problem with using SAC is that you can’t add exceptions. If you use it for a few years, the probability that something you really need is not allowed to run will be quite high. If you use WDAC with ISG instead, here is how it works and which data is sent to Microsoft: > WDAC only checks the ISG for binaries that aren’t explicitly allowed or denied by your policy, and that weren’t installed by a managed installer. When such a binary runs on a system with WDAC enabled with the ISG option, WDAC will check the file’s reputation by sending its hash and signing information to the cloud. If the ISG reports that the file has a “known good” reputation, then the file will be allowed to run. Otherwise, it will be blocked by WDAC. By explicitly allowing your most used applications in your wdac policy you can also make the amount of data sent to Microsoft smaller, because ISG is not consulted for these. Getting started with WDAC is not that difficult, but it takes some time to get into. It can considerably boost security. The problem is the lack of good, concise docs and tooling. With good tooling it could be quite easy. --- ## Post 174 by @jerm — 2024-01-06T23:20:00Z > **[GitHub - starchturrets/windows-shenanigans: Just my notes on how to](https://github.com/starchturrets/windows-shenanigans)** > > Just my notes on how to might help --- ## Post 175 by @cromagnonymous — 2024-03-02T17:34:25Z > [@anon34108895](#): > > [Signed and Reputable Mode](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-create-base-policy#:~:text=Microsoft%2Dsigned%20software-,Signed%20and%20Reputable%20Mode,-Signed%20and%20Reputable) in [WDAC wizard](https://webapp-wdac-wizard.azurewebsites.net/) is basiclly SAC. this does not require a clean install. If you decide to do a clean install, remember to select your region to EU(to uninstall Edge and Bing) and accept optional diagsnotic data(to turn on SAC) during the out-of-box-experience. I also recommend to use a Enterprise edition so there is a UI option in OOBE to skip Microsoft account. > After creating WDAC files using the wizard, you can apply it to your pc using [scripts](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/deployment/deploy-wdac-policies-with-script). If you are not sure if it’s suitable for you, use audit mode. SAC and default Signed and Reputable Mode is suitable for normal users imo. > […] > If you are a developer, if you wanna use WSL, WMIC, do [not](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac#:~:text=wscript.exe-,wsl.exe,-wslconfig.exe) use SAC. Could you expand on what you mean by “if you are a developer”? Do you mean literally using IDEs like Visual Studio, or just any power user who installs less-common apps? Also, what do you mean by “apply it using scripts”? I’m new to WDAC and not sure how to go about setting it up. I had enabled SAC Audit mode when I first installed Windows, but it looks like it decided to disable itself. I’m running Windows 11 Enterprise and now have **all** telemetry disabled, mostly via GPO. What’s the bare minimum I would have to reenable to make WDAC work? > [@sha123](#): > > Getting started with WDAC is not that difficult, but it takes some time to get into. It can considerably boost security. The problem is the lack of good, concise docs and tooling. With good tooling it could be quite easy. Do you have any suggestions or guides for how to get started, particularly for an existing Windows installation (which still has a pretty high confidence for being malware-free)? --- ## Post 176 by @anon34108895 — 2024-03-03T02:03:22Z You can refer to section 5 in [Instructions on Hardening Windows (What I Have Learnt So Far)](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102) A developer would run unsigned scripts or apps on their host machine a lot. --- ## Post 177 by @anon34108895 — 2024-03-29T06:44:02Z hey guys I created a new [Windows Guide](https://github.com/privacyguides/privacyguides.org/pull/2452) pr. everyone is welcomed to contribute! --- ## Post 178 by @user1 — 2024-03-29T07:28:33Z I really appreciate the effort but that looks more to a list (enable this, disable that, etc.) rather than a guide. There are almost no explanations on what and why you should do the changing and what exactly you are trying to achieve. Also there’s a LOT of setting changes, it looks like more a total hardening lockdown than a recommended general configuration. Maybe a more simplified approach would be better (or split recommended and advanced settings). I suggest you to take a look at the other OS overviews and remodel on that. Thanks for the so much needed work, I really hope a Windows guide will finally see the light. --- ## Post 179 by @anon34108895 — 2024-03-29T10:12:13Z I know there’s a lot more work to do and I think it’s a good starting point :smiley: --- ## Post 180 by @anon97654407 — 2024-03-30T14:18:32Z I don’t think we should make a complete overhaul of the Windows Guide, as I think @ikelatomig’s PR is already a great starting point to rework the Windows guide. We should just rework some things here and there, update info, etc… --- ## Post 181 by @ikelatomig — 2024-04-01T03:28:30Z Somebody mail me on May 9th or the 8th. I will have everything over and giddy up myself and finish the draft within a week. So, It is possible for people to give suggestions and add their own taste of corrects, either technically, factually or grammatically. It is my fault that, the PR has merge conflicts. But there is been a new PR by @anon34108895 In the new PR, my opinions, - there is a point for Optional Diagnostics to be enabled. More people will contradict about that. Required is enough. - There is no need to loop Windows Enterprise from Pro to Enterprise. There is an ISO where you can do that directly. - Do not suggest KMS activation scripts, It is up to the user to activate them. There is [https://massgrave.dev](https://massgrave.dev) but I am not sure how to link them and safely say PG and him are not related. - Actually wanted to check about Security baselines. Never got the time. - App sandbox is not true for UWP. There are apps which can have full access to the system despite being .msix or .appx - For TPM, It depends on the user’s threat model. You need to detail it without lot of wordings but in a sentence. So, users choose what they want. - Be sure about exploit guard as it randomizes the kernel memory causing some programs to break such as Git, GCC, etc. - For the group policy maybe we need to create a file that enables it like registry files. And if done, we should state that, it could be easily checked that there is no malware by opening it with notepad. - Again, don’t speak about activation. I would say. Even though it is about using own KMS servers. What should we do ?? Not to like discourage, but if you can see the markdown files in my PR cuz currently preview is broken. Work separately and merge the best of them. I literally have no idea. @dngray or @jonah - what do you say ? --- ## Post 182 by @ikelatomig — 2024-04-01T03:30:01Z And in the overview page, it should be about a general Overview of Windows. And all the other things should go under recommendations. --- ## Post 183 by @Sprout3425 — 2024-04-01T03:45:51Z I say combine the guides and remove overlapping information, by choosing the best parts in this case. Focus on making the guides easy to implement, scripts (or batch scripts, I don’t know the technical term) or whatever makes the process the easiest are _definitely_ favoured, before these scripts are provided we could have a description of what they do and effect, and how to revert them, this would mean everything should go smoothly! --- ## Post 184 by @anon73250778 — 2024-04-01T05:05:00Z I feel like the Windows guide will forever be a moving target, more so than the usual moving targets of updates in MacOS and the various Linux distros out there. Microsoft likes to change things in what feels like a whim most of the time, apart of the usual configuration resets to their default values during each update. I think the best way forward is just put Windows 11 in a VM so as to avoid the tantrums it does with each update. It also has the bonus of having the capability of having a whole image backup (along with all its hassles) and the ability to firewall(?) the VM, or allow specific domains to connect. Do we have the capability to just download the updates piecemeal or does the VM have to be completely online to do Window Updates? --- ## Post 185 by @dngray — 2024-04-01T11:04:20Z > [@ikelatomig](#): > > Work separately and merge the best of them. I literally have no idea. @dngray or @jonah - what do you say ? Will be reviewing this, tidying up the hardware guide which touches on windows secure core then will be looking at the windows PR next. We will likely have the later PR superseed the previous one, but I’ll check to see nothing was missed in the comments of those PRs and in the merge request. A single PR can always have co-authors, so we’ll make sure to put the original author on there as a co-author of it using the [`Co-authored-by`](https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors) keyword in the commit. That way you will get credit for it on your Github activity. --- ## Post 186 by @sha123 — 2024-04-01T20:48:17Z Would suggest to split up a Windows guide into different parts. For example one for privacy, one for security, intersections of security and privacy, and maybe a setup guide (how to make an installer, which edition to choose, showing differences, driver best practices and so on). Stick to official guidelines and baselines as much as possible with little reliance on third-party tools. Start with privacy, because that’s the most important part for PrivacyGuides and also the most difficult. It will be a big part. Show how to apply Windows Restricted Traffic Limited Functionality Baseline. Show which things must be patched afterwards (preferably provide a ready-to-use patch policy), for example to make Updates (Windows, Defender, Certificates), Store and a few more, which are needed for a secure and working distro. Show which can optionally be patched. Show privacy consequences and considerations (for example some users might want to be able to use XBOX services while others don’t). Show differences between Enterprise editions and Pro (e.g. which settings won’t take effect and whether there are other ways to achieve it). Explain considerations between privacy and security (e.g. Defender cloud protection, SAC, ISG). Show which built-in apps can be used in a privacy respecting way, whether settings are necessary to adjust and when it’s better to simply delete the app. Show which services and apps can or should be disabled/deleted. Show blocking of network communication with DNS filters and solutions like Simplewall to whitelist apps and which apps need to be whitelisted to keep the system secure and working. Then you can start with security (or different people working on it in parallel), but the privacy guide should be worked on with higher priority, because it will also be needed for security vs privacy considerations. Security baselines, WDAC, Applocker, bitlocker, ISG, SAC, ASR-Rules, exploit protection rules and so on. All solutions have different consequences for privacy, security and usability, so a lot of explanation is needed (e.g. for which use cases is metadata transmitted for ISG acceptable). Explain why to apply privacy settings after security baselines, if users prefer privacy over security. That’s just what quickly comes to mind. As you see this will be a long guide. --- ## Post 187 by @dngray — 2024-04-02T02:17:49Z > [@sha123](#): > > Would suggest to split up a Windows guide into different parts. For example one for privacy, one for security, intersections of security and privacy, and maybe a setup guide (how to make an installer, which edition to choose, showing differences, driver best practices and so on). Stick to official guidelines and baselines as much as possible with little reliance on third-party tools. 100% this is one of the reasons we hadn’t actually gotten around to doing this. Writing the general material was the easy part but talking about the [LGPO](https://www.microsoft.com/en-us/download/details.aspx?id=55319) policies was going to be the time consuming portion. What you suggested in [your post](https://discuss.privacyguides.net/t/windows-guide/250/186) is exactly what I had in mind though. I can’t say I am a fan of things like privacy.sexy because modifying registry entries directly isn’t really the right way to do that. --- ## Post 188 by @sha123 — 2024-04-02T07:46:22Z > [@ikelatomig](#): > > App sandbox is not true for UWP. Afaik all UWP apps are sandboxed. However UWP devs can ask for special permissions, which need special approval from Microsoft to get into the Store and can weaken the sandbox or allow more broad access. And UWP devs can ship a desktop bridge for more broad or even full desktop access. I am not sure if you need to confirm installation of both, the UWP part and the bridge in this case of how security is handled there. Microsoft Store uses both approaches for its own app. You might be confusing UWP with apps on Microsoft Store. Microsoft store does distribute different forms of apps. --- ## Post 189 by @anon34108895 — 2024-04-02T07:58:42Z > [@dngray](#): > > Writing the general material was the easy part but talking about the [LGPO](https://www.microsoft.com/en-us/download/details.aspx?id=55319) policies was going to be the time consuming portion. The Windows guide I envision would have a user interactive interface that can export corresponding LGPO files based on selected policies with explanations. This would also make my new Windows guide pull request look more concise. However, unfortunately, explaining each policy would be exhausting, and I don’t know how to write this kind of interactive interface. Also we should avoid registry modification and make a group policy file for all registrys not in the current group policy editor. Though I have no idea how to make a admx/adml file. > [@sha123](#): > > Windows Restricted Traffic Limited Functionality Baseline This is NOT recommended as it disables Windows Update and lots of important things. For security, Security Baselines are recommended. > [@ikelatomig](#): > > there is a point for Optional Diagnostics to be enabled. More people will contradict about that. Required is enough. Both optional diagnostics and required diagnostics data are not necssary. > [@ikelatomig](#): > > There is an ISO where you can do that directly. Not sure if thats applicable to ARM version. > [@ikelatomig](#): > > Do not suggest KMS activation scripts Why? activating windows enterprise is not piracy. the code in my guide is official code from Microsoft. using third party scripts or modifying system components to activate is a security threat. We should avoid things like [https://massgrave.dev/](https://massgrave.dev/) > [@ikelatomig](#): > > App sandbox is not true for UWP. There are apps which can have full access to the system despite being .msix or .appx You didn’t read my pr carefully enough. [Here](https://github.com/privacyguides/privacyguides.org/pull/2452/files#diff-f51d1a48eb570721cd6bedfc8a245079fb3ef5653829322e247634ffff00994a:~:text=If%20you%20sideload%20apps%2C%20only%20those%20with%20the%20file%20extensions%20%60.msix%60%2C%20%60.msixbundle%60%2C%20%60.appx%60%2C%20%60.appxbundle%60%2C%20and%20without%20the%20permission%20%22This%20app%20can%20access%20all%20your%20files%2C%20peripheral%20devices%2C%20apps%2C%20programs%2C%20and%20registry%22%20are%20sandboxed.) > [@ikelatomig](#): > > For TPM, It depends on the user’s threat model. No. TPM is a must for Windows 11. Anyway, thank you for your time @ikelatomig --- ## Post 190 by @dngray — 2024-04-02T08:01:41Z > [@anon34108895](#): > > The Windows guide I envision would have a user interactive interface that can export corresponding LGPO files based on selected strategies with explanations. This would also make my new Windows guide pull request look more concise. However, unfortunately, explaining each policy would be exhausting, and I don’t know how to write this kind of interactive interface. I’m thinking this might be something we might do as a revised version of the page, but not immediately to begin with. > [@anon34108895](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/sha123/48/14_2.png) sha123: > > > Windows Restricted Traffic Limited Functionality Baseline > > This is NOT recommended as it disables Windows Update and lots of important things. For security, Security Baselines are recommended. Likely the reason that is because the baseline disables much of the reliance on MS and is really meant to be used in high security environments where devices are part of a larger workgroup with local [WSUS](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). --- ## Post 191 by @anon34108895 — 2024-04-02T08:07:42Z > [@dngray](#): > > a larger workgroup with local [WSUS](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) Oh I never thinked about that. Should PG provide guides for such users? --- ## Post 192 by @sha123 — 2024-04-02T08:54:54Z > [@anon34108895](#): > > This is NOT recommended as it disables Windows Update and lots of important things. Pls read further what I wrote. I wrote to patch the policy so that it won’t disable security critical things like Windows update. It’s less work to apply everything and patch only the few things needed than to apply everything by hand. Patching can be done by editing the baseline before applying it or afterwards by applying the patches as a separate policy. --- ## Post 193 by @sha123 — 2024-04-02T08:57:31Z > [@dngray](#): > > Likely the reason that is because the baseline disables much of the reliance on MS and is really meant to be used in high security environments where devices are part of a larger workgroup with local [WSUS](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Well, it’s a baseline. They are supposed to be adjusted and that’s also what I would propose. It’s easier to use the baseline and adjust it to your needs either by editing it or applying patches afterwards than to apply privacy settings by hand. --- ## Post 194 by @dngray — 2024-04-02T09:22:58Z > [@anon34108895](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/dngray/48/21_2.png) dngray: > > > a larger workgroup with local [WSUS](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) > > Oh I never thinked about that. Should PG provide guides for such users? No, i don’t think so, because that requires a windows server as well, and really ads no privacy benefit. You also then need to do a tonne of other things. We don’t want PG to basically become learn.microsoft, but when there are relevant articles I’m happy if we link to those in the course of whatever it is we’re explaining. --- ## Post 195 by @anon80779245 — 2024-04-04T00:53:29Z I think there are 3 threads about this Windows Guide, could we just use one ? --- ## Post 196 by @Sprout3425 — 2024-04-04T03:28:38Z ### Advice Definitely feel free to use my original [post](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102/53) as an inspiration, but do acknowledge if you use some of it. Note: @anon34108895 has contributed the most to that post and @sha123 has also contributed. As I said before keep it simple, do not overwhelm yourselves, we do not need to explain the purpose of each setting, **at the very least their implications need to be explained (for 99% of the modified settings you won’t notice a difference)**, I went through the painstaking process of applying all of this, so do use my experiences to identify some implications, **I identified the main ones in my original post**. ### To do list: 1. Combine the guides and remove overlapping information, by choosing the best parts in cases where overlapping info is present. You could use software to do this by comparing the guides as text files. 2. Use AI sparingly and strictly as a grammar checker, this is a no-brainer, but ensure to only let it edit small chunks of text at a time and prompt it to not change the meaning of the text, when it inevitably does change the meaning of the text without telling you, you should be able to notice if you go chunk by chunk. Do not risk making it format large chunks of text because it will omit things and change the meaning of things without telling you. 3. **Important goal** : Focus on making the guides easy to implement, scripts (or batch scripts, I don’t know the technical term) or whatever makes the process the easiest are _definitely_ favoured, before these scripts are provided we could have a super brief description of what major settings do and effect, and how to revert them, this would mean everything should go smoothly! By major settings I mean the only settings people might notice. Assume an average computer user. If you do this you don’t have to bother explaining how to do it manually this will save _everyone’s_ time! I do understand this is tricky because so many settings are changed in the baselines, heck I do not know if some settings are effecting me negatively. I think you all know what to do, good luck! --- ## Post 197 by @dngray — 2024-04-04T03:43:25Z > [@anon80779245](#): > > I think there are 3 threads about this Windows Guide, could we just use one ? :100: I have locked the two other threads - ['Hardening' Windows - #115](https://discuss.privacyguides.net/t/hardening-windows/15750/115) - [Instructions on Hardening Windows (What I Have Learnt So Far) - #54](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102/54) and want to direct the discussion here. I thought about merging the threads but that might create a bit of unnecessary clutter. --- ## Post 198 by @anon80779245 — 2024-04-07T09:38:17Z Why are we including Microsoft Edge in the Windows Guide ? I see no reason to use Edge, which isn’t a desktop browser recommended by PG (neither is Safari). Now I understand we include for Microsoft Office as it might be a reason people use Windows in the first place, but I don’t see Edge as having any added value. We have other great browsers. --- ## Post 199 by @dngray — 2024-04-07T09:43:12Z > [@anon80779245](#): > > Why are we including Microsoft Edge in the Windows Guide ? The main reason is because if you’re already on Windows you can make use of [Microsoft Edge and Microsoft Defender Application Guard | Microsoft Learn](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard) which further isolates the browser. --- ## Post 200 by @anon80779245 — 2024-04-07T10:19:31Z So this a great security but terrible privacy type of scenario ? --- ## Post 201 by @sha123 — 2024-04-07T16:30:34Z > [@dngray](#): > > The main reason is because if you’re already on Windows you can make use of [Microsoft Edge and Microsoft Defender Application Guard | Microsoft Learn](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard) which further isolates the browser. Edge configuration should be separated from a Windows guide and have a big warning because it constantly gets new invasive features. Edge is a constant effort to keep private, so basically more an anti-recommendation. Also MDAG will be deprecated. --- ## Post 202 by @dngray — 2024-04-07T16:31:51Z I agree, I think if we did anything in that regard should just be a blog post and not part of the main guide as that’s a better place for content which could go out of date quite quickly/need updating. --- ## Post 203 by @jonah — 2024-04-13T04:17:09Z > [@anon80779245](#): > > Why are we including Microsoft Edge in the Windows Guide ? That won’t be the case, I will never approve a PR which recommends Microsoft Edge. We wouldn’t recommend any browsers that don’t meet our browser [criteria](https://www.privacyguides.org/en/desktop-browsers/#criteria) anyways. --- ## Post 204 by @Tech-Trooper — 2024-04-13T17:17:41Z Using Edge just because you are using windows does not make sense. In a similar vein, PG can suggest chrome on android just because it’s a Google-managed operating system, or Apple mail and notes on Apple devices. --- ## Post 205 by @lepras — 2024-04-13T18:02:22Z > [@Tech-Trooper](#): > > Using Edge just because you are using windows does not make sense I actually think edge == brave in terms of privacy. --- ## Post 206 by @sha123 — 2024-04-13T18:07:35Z > [@lepras](#): > > I actually think edge == brave in terms of privacy. What did you smoke? --- ## Post 207 by @lepras — 2024-04-13T20:55:45Z > [@sha123](#): > > What did you smoke? Typo. I actually meant to write ltsc-hardened-edge. Can block Microsoft with postmaster too. --- ## Post 208 by @Tech-Trooper — 2024-04-14T15:36:56Z We don’t operate based on feelings. :slight_smile: I have a completely different feeling that microsoft, a company putting [ads on start menu](https://www.tomsguide.com/computing/windows-11-is-getting-more-ads-in-the-latest-preview), will make it worse day by day. --- ## Post 210 by @Average_Joe — 2024-04-23T17:40:35Z > [@lepras](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/tech-trooper/48/1539_2.png) Tech-Trooper: > > > Using Edge just because you are using windows does not make sense > > I actually think edge == brave in terms of privacy. :scream: :scream: Are you crazy?? --- ## Post 211 by @ikelatomig — 2024-05-17T01:55:55Z This thing is really damn lot of work. I don’t even know why I still want to work on this thought I have switched to linux. --- ## Post 213 by @ikelatomig — 2024-05-17T09:53:04Z I am thinking of Outright stopping my work on the PR. Let them take whatever they want. --- ## Post 214 by @anon34108895 — 2024-05-17T10:13:08Z It’s a pity but I still wanna thank you for the work done. --- ## Post 215 by @anon86237473 — 2024-05-17T10:57:05Z I feel you. Been trying to just compartmentalize with dual-boot and isolated wifi network. But then school requires software which only works on Windows and switching OS is cumbersome and shit just starts creeping over again. Why can’t there just be a desktop equivalent of GrapheneOS that just works. Anyho, we love and appreciate your effort as much as you hate doing it :kissing_heart: --- ## Post 216 by @ikelatomig — 2024-05-17T11:01:52Z Thank you for the words. Despite hating to working on it. I am no longer interested on it do. Hence why, I also wanna touch the grass. --- ## Post 217 by @anon86237473 — 2024-05-17T11:17:40Z Well that is one of the perks of volontary work – it’s volontary. So go frolick in the green grass my friend and hopefully someone else will become our new ~~Sisyphus~~ Atlas later on. --- ## Post 218 by @anon80779245 — 2024-05-17T11:49:31Z Just let the PR open but let it die --- ## Post 219 by @Sprout3425 — 2024-05-17T14:23:21Z Nature is beautiful! --- ## Post 220 by @ikelatomig — 2024-05-17T14:28:42Z Well, It’s been dead for 2 years. I fixed my merge conflicts and I have the preview enabled now. That’s it. It will continue being so. The main problem during the 2 years is Preview was broken. --- ## Post 221 by @ikelatomig — 2024-05-17T14:29:58Z Someone stepped on it. Hope they take some insights too. I guess. Let’s see how this comes off in the end. --- ## Post 222 by @Sprout3425 — 2024-05-18T02:59:41Z Too early to say that it will die, someone might pick it up. Windows is probably the biggest OS in terms of users in the world. Me personally I hate it. But, I would also hate to have to deal with compatibility issues with programs and stuff, which I know you can avoid using dual booting, where you have multiple OS’s. --- ## Post 224 by @ikelatomig — 2024-05-22T05:47:03Z I switched to Linux in August, the last year. I needed some learning curve but not much. But after setting up everything I need. There is no going back for me. It just works. I don’t even care about Windows. Everything I need is available except WhatsApp Desktop and OTT Apps which would be better for Offline use cases. I almost switched every one of the apps I used in windows to FOSS here. Just no hassle. I don’t dual Boot. I have a Windows 10 VM incase if there is something I might really need but I don’t even open it. I just open once or twice a month to update it. Nothing much. My VM setup is QEMU/KVM (Linux native VM like Hypervisor in Windows). It is just flawless, fast and smoother without any hiccups. If you just have some sufficient RAM. --- ## Post 225 by @Sprout3425 — 2024-05-22T09:12:57Z Linux takes less RAM then Windows, so you don’t even need that. Congratulations on the big move, I hope I make the move soon too! Surely Linux can make it easy to download apps somehow, like if I want to play a game, download a bioinformatics program… --- ## Post 226 by @ikelatomig — 2024-05-24T03:57:23Z A major discussion is needed. Apart from the fact, I am abandoning it. Does this still matter ? Because Microsoft introduced CoPilot + PC recently and will keep on adding more features in the end privacy does not exist in their software. What we are creating will be essentially for the average Windows before CoPilot + PC was introduced which will be soon neglected by users and switch to it. I think it’s kind of waste of resources. Statistically and hypothetically speaking. If 75% percent of windows users are going to switch to it. Then, the remaining 25% will stay on the older one, we could say 10% of them will be looking on our guide. Windows 10 is still rocking the globe compared to the now Windows 11. We could write the guide for it. But it will be abandoned next year, but not if we recommend users to use Windows 10 IoT Enterprise LTSC supported until 2032. What we could recommend in the end is security only. Before proceeding forward, we need to discuss the current state of Windows and the future implications imposed by the company behind it. So, the guide comes out well. --- ## Post 227 by @ikelatomig — 2024-05-24T04:04:52Z You could say that you can’t obtain the ISO but I did from massgrave.dev and verified the hash files from sites apart from those listed by them. I use it in my VM. I haven’t activated it, I am fine with the watermarks, etc as I don’t use it much. So, I don’t violate the policy as of now. I just didn’t download from the official site. That’s it. Even if we recommend that there is no Windows store support which needs to be done manually by the user. And comparing with the security features there are some features that can be enabled manually some doesn’t even support it due to hardware issues. There are major differences and complexities involving in this. I highly doubt if the outcome will be in a good state or not. As said earlier, the OS will be adding things, that essentially eliminates privacy. P.S. I am open to discussions regarding this but not ready or willing to work on the PR. --- ## Post 228 by @anon34108895 — 2024-05-24T06:57:40Z It’s annoying but it’s not a big problem imo because it’s configurable. Windows has always been not a privacy-respecting OS cause it’s difficult to configure privacy settings but Copiot+ does not make it worse. --- ## Post 229 by @SuchAnon — 2024-05-24T10:19:05Z I agree with this. It’s disturbing to see how much emotion-based debate is happening in the privacy community regarding Copilot+. Currently, Copilot+ doesn’t even support traditional CPUs. Considering the new hardware requirements that came with Windows 11, it’s possible that Copilot+ may never be available for existing CPUs. If Copilot+ eventually becomes available to all Windows users, it can be turned off, similar to the Inking and Typing Personalization feature, which is the main source of “Windows is a keylogger” claims. Another recent discussion has been about advertisements in the Start menu. I haven’t personally encountered any, but from my understanding, they promote apps from the Microsoft Store, and this feature can also be easily disabled. While it’s true that Windows isn’t very privacy-friendly, it seems that few people take the time to thoroughly research what it actually tracks and how. --- ## Post 230 by @Sprout3425 — 2024-05-24T10:30:15Z Here is my analysis: I agree with @ikelatomig’s overall sentiment, in essence, they say: what is the point of going through the trouble of hardening windows (a pain in the…) if much better alternatives exist, in terms of privacy, environmental friendliness/performance/efficiency and security(?). However, we need to address the elephant in the room, Windows is the most used OS in the world because it is easy to use and convenient. Hence, we need to find compromises. Compromises: - Find the easiest one click solution to harden Windows, such as installing Enterprise versions or scripts. - Find a Linux distribution that addresses the strengths and shortcomings of Windows, importantly, focus should be on a distribution that is _easy_ to use and versatile, in that it users should be able to download common applications like games without issues. Honestly, to me Linux seems more intuitive then Windows, which is a mess of an OS. So there is potential here. --- ## Post 231 by @anon34108895 — 2024-05-24T12:06:43Z and I think the Windows guide should manly focus on the latest version OS. Windows 11 23H2/24H2 Home/Pro/Edu/Enterprise on physical machine imo. --- ## Post 232 by @lepras — 2024-05-24T12:16:06Z > [@anon34108895](#): > > Windows 11 23H2/24H2 Home/Pro/Edu/Enterprise When ltsc? --- ## Post 233 by @ikelatomig — 2024-05-24T13:05:01Z LTSC is enterprise only. So, focusing on it is kind of pointlesss. If you are purchasing it in a genuine way. You would pay a hefty licence fee. Users would say, crap, I will just go with Pro. And for LTSC, there is no store support, which most users need as you can’t even install UWP apps manually like apk in android. --- ## Post 234 by @lepras — 2024-05-24T13:34:55Z > [@ikelatomig](#): > > which most users need as you can’t even install UWP apps manually like apk in android. [https://github.com/Kapustaaaa/LTSC-Add-MicrosoftStore](https://github.com/Kapustaaaa/LTSC-Add-MicrosoftStore) --- ## Post 235 by @mika — 2024-05-24T14:48:21Z > [@Sprout3425](#): > > Here is my analysis: > I agree with @Ikel’s overall sentiment, in essence, they say: what is the point of going through the trouble of hardening windows (a pain in the…) if much better alternatives exist, in terms of privacy, environmental friendliness/performance/efficiency and security(?). > > However, we need to address the elephant in the room, Windows is the most used OS in the world because it is easy to use and convenient. Hence, we need to find compromises. Yes, we need recommendations for Windows because tons of people, including many users of this forum (including me), have to use Windows for various reasons and want to improve their privacy and security while doing so. I do not think having the Windows recommendation being “switch to Linux!” makes sense. Linux is already the top recommendation on PG and shouldl remain that way. But if someone is looking for help with Windows, they’re looking for help with Windows. --- ## Post 236 by @jerm — 2024-05-26T11:54:32Z Everyday it becomes harder to recommend Windows [https://yewtu.be/watch?v=rhhTOYCEgGo](https://yewtu.be/watch?v=rhhTOYCEgGo) --- ## Post 237 by @anon34108895 — 2024-05-26T13:30:36Z I do think we should include some crutial parts of OS in the Knowledge\>Operating System part, like browsers, file managers, antivirus and app stores that come with the OS. The whole point of this section is _if you choose to use the OS and the crutial attached apps, what should you do._ You cannot detach Windows Defender, Microsoft Store, Edge and Edge Webview from Windows without adding attack surface or destabilizing OS. You also cannot detach App Store and Webkit from iOS without adding attack surface or destabilizing OS. Refusing Edge recommendation in Windows Guide while allowing Safari, iCloud and App Store recommendation in iOS Guide is wrong and unfair. I opened a [Windows Guide 2024](https://github.com/privacyguides/privacyguides.org/pull/2452) PR in march because the original PR has no progress in years. I decide to keep the PR closed until Edge recommendation is allowed. --- ## Post 238 by @mika — 2024-05-26T14:03:41Z > [@jerm](#): > > Everyday it becomes harder to recommend Windows Making recommendations for those that use Windows =/= recommending Windows. --- ## Post 239 by @jerm — 2024-05-26T18:05:33Z Then we should also make recommendations for Telegram and Whatsapp users? We should give people better privacy advice to other alternatives, Windows is never marketed as a “privacy” respecting product. --- ## Post 240 by @jonah — 2024-05-27T05:50:46Z I’m not quite sure what you’re asking for. Unfair to who, Microsoft? It’s not my job to promote their browser/products :person_shrugging: --- ## Post 242 by @sha123 — 2024-05-27T08:58:03Z > [@anon34108895](#): > > I decide to keep the PR closed until Edge recommendation is allowed. Why is Edge recommendation so important to you? Reading through Edge’s privacy whitepaper shows that it needs _a lot_ of configuration to even get close to being somewhat privacy respecting. Edge gets invasive on-by-default features with updates again and again, so it is a constant battle to keep up with it. The security advantages are mainly gone: JIT-toggle is now available in every Chromium browser and MDAG for Edge is going to be deprecated. Configuring Edge would need another big guide, which would be very difficult to maintain, because of Edge’s constant changes and bad stance on privacy. For people willing to use Edge and keep up with it, fine, why not. But it is not something to recommend for the average privacy user. > [@anon34108895](#): > > Refusing Edge recommendation in Windows Guide while allowing Safari, iCloud and App Store recommendation in iOS Guide is wrong and unfair. Safari can be made reasonably private, with less adjustments and had some privacy features like state partitioning very early. --- ## Post 243 by @mika — 2024-05-27T14:39:25Z > [@jerm](#): > > Then we should also make recommendations for Telegram and Whatsapp users? > > We should give people better privacy advice to other alternatives, Windows is never marketed as a “privacy” respecting product. PrivacyGuides already has guides on configuring iOS, macOS, and non-Graphene Android in the Knowledge Base, which is different from the recommendations page. There is no reason Windows shouldn’t be right next to them. The site also has recommendations for email services and clients even though email is inherently insecure, recommendations for Manifest V3 ad blockers even though Chrome isn’t recommended, recommendations for iOS security tools even though iOS isn’t recommended, etc. You have to meet people where they’re at. --- ## Post 244 by @anon34108895 — 2024-05-29T04:22:37Z > [@jonah](#): > > I’m not quite sure what you’re asking for. You didn’t read my answer carefully enough. I said clearly that I want Edge recommendation to be allowed. > [@sha123](#): > > Why is Edge recommendation so important to you? The reason is simple. Not all of Windows users can uninstall Edge and leave an unconfigured Edge on your Windows is Attack surface. Even if you use third party browsers you should configure Edge. --- ## Post 245 by @anon39565454 — 2024-05-30T16:35:25Z Considering it’s already about windows guide, we should just include a guide to force windows to think it’s an EU computer and allows us to uninstall edge, and then uninstall edge. Problem solved eg. [How to remove Microsoft Edge from Windows 11 in the latest EEA-compliant update - Neowin](https://www.neowin.net/guides/how-to-remove-microsoft-edge-from-windows-11-in-the-latest-eea-compliant-update/) --- ## Post 247 by @user1 — 2024-05-30T18:32:01Z Very nice so far! The group policy section is very clear and not overwhelming. Keep up the good work guys. --- ## Post 248 by @anon34108895 — 2024-06-03T01:28:09Z @jonah You didn’t respond to my request to add Edge recommendation. Instead, you just submit a Windows Guide PR that contains rediculously wrong infomation such as > we would recommend using Windows 10 for as long as possible. I’m really disappointed by PG now. --- ## Post 249 by @dngray — 2024-06-03T03:06:20Z > [@anon34108895](#): > > > we would recommend using Windows 10 for as long as possible. > > I’m really disappointed by PG now. I’ve specifically made that change in [#2606](https://github.com/privacyguides/privacyguides.org/pull/2606) as well as removed some of the “proprietary” stuff because it’s not really relevant. macOS is “proprietary” also, and this really has nothing to do with privacy. The other part I am seeking information on there is: > Some privacy features in Windows 11 are locked to devices in the European Union. We have not yet found a way to reliably access those settings worldwide. What features exactly are was the article talking about? --- ## Post 251 by @batman — 2024-06-03T08:03:46Z Some programs utilize the name of the pc or system’s product name [link](https://winaero.com/how-to-change-system-product-name-in-windows-11/) to identify users or when you use it across systems maybe add to the guide telling people to put more generic name --- ## Post 252 by @anon40524387 — 2024-06-05T09:53:32Z > [@anon82677111](#): > > Microsoft edge is the **only** browser I’d recommend for Windows users as it is the only one that natively supports hardware isolation and allows disabling JIT. Are you saying that because of security or privacy? --- ## Post 253 by @sha123 — 2024-06-05T10:27:38Z > [@Sergi2715](#): > > Are you saying that because of security or privacy? His account was deleted, but he said it because of security. But a JIT toggle is now available on any desktop Chromium browser and hardware isolation (MDAG) will be getting deprecated (it’s still usable atm) --- ## Post 254 by @ikelatomig — 2024-06-05T10:59:50Z [https://alternativeto.net/news/2024/6/microsoft-blocks-new-workarounds-for-creating-local-accounts-in-windows-11-setup/](https://alternativeto.net/news/2024/6/microsoft-blocks-new-workarounds-for-creating-local-accounts-in-windows-11-setup/) More the reason not to use Win11 --- ## Post 255 by @anon40524387 — 2024-06-05T11:27:00Z I still have a local account and I am on the dev insider preview… but yeah I know this is about during setup right? There are more workarounds? --- ## Post 256 by @batman — 2024-06-05T12:17:34Z ensure you’re offline. press Shift + F10 in CMD Type OOBE\BYPASSNRO and press enter --- ## Post 257 by @Dkama — 2024-06-06T02:32:41Z This thread just popped up again and it reminded me of something. I installed Windows 11 Enterprise on a VM, followed the proposed guide and watched for a while. AdGuardHome still caught a few DNS request for “telemetry” urls. Unfortunately it’s been so long now that I don’t have the evidence anymore, or even remember the details. I wanted to Wireshark it for a while but ended up forgetting about it. PS: oh and for those who haven’t seen it, Windows was caught bypassing their “telemetry” fronts and talking directly to the government cloud they host: 1- [Suspicious data collection after Windows 11 updates. : privacy](https://old.reddit.com/r/privacy/comments/1cstra9/suspicious_data_collection_after_windows_11/) 2- [Found on r/pihole queries to ic.gov : privacy](https://old.reddit.com/r/privacy/comments/1csyn2k/found_on_rpihole_queries_to_icgov/) --- ## Post 258 by @anon40524387 — 2024-06-06T05:13:32Z > [@Dkama](#): > > I installed Windows 11 Enterprise on a VM, Ok this reminds me I need to upgrade from Pro to Enterprise. --- ## Post 259 by @Dkama — 2024-06-06T11:32:26Z People suggest Edge because of security, definetly not privacy. If you’re OK with being hacked by professionals (ok, not hacked, MS and the NSA are more like your network admins), it lowers your chances of being hacked by amateurs. It’s called “security” lol. By the JIT argument has been made outdated, as I understand all Chromium allow disabling it now. --- ## Post 260 by @Bhaelros — 2024-06-06T13:44:57Z One thing to consider, if you uninstall Edge, some of your Windows Store apps will not work, especially the streaming apps like Disney and Paramount. Edge is secure but totally not privacy focused, and it is bloated. --- ## Post 266 by @Bhaelros — 2024-06-11T22:33:44Z They are using Edge to connect to their servers. My test was simple. I started streaming apps, like Paramount+ and it started Edge. I killed Edge from task manager and Paramount gone too. --- ## Post 267 by @ikelatomig — 2024-06-12T00:50:53Z So, Various OTT apps use WebView instead of a Native Implementation. That sucks. --- ## Post 268 by @Zombie.Turtle — 2024-06-26T15:05:23Z I wanted to create a thread about OneDrive, but it seems like I should direct myself here for Microsoft-related questions. 1. How do I permanently remove Edge from my computer? Are there any other pre-installed softwares that I should know of to get rid of and alternatives to them? What should I be worried about and not be worried about? 2. I am moving a lot of my documents and photos from OneDrive to my physical drive. I still haven’t come up to the conclusion on which privacy-oriented service to switch to. With that said, I am also having an argument with another individual who swears on Microsoft OneDrive’s security. Equating it to Tresorit’s security, for example. I am not a privacy veteran. I am quite new to this environment and I don’t know where to find the data or statistics to show him on OneDrive’s privacy/security. Thanks for reading. --- ## Post 269 by @anon48875053 — 2024-06-26T15:20:51Z > [@Zombie.Turtle](#): > > How do I permanently remove Edge from my computer? If you’re from Europe then you can just uninstall it like any other app. --- ## Post 270 by @Zombie.Turtle — 2024-06-26T15:25:06Z Unfortunately, I am not in Europe. --- ## Post 271 by @exaCORE — 2024-06-26T23:47:51Z > [@Zombie.Turtle](#): > > How do I permanently remove Edge from my computer? Don’t use windows :slight_smile: --- ## Post 272 by @Zombie.Turtle — 2024-06-27T00:07:45Z > [@Zombie.Turtle](#): > > I am moving a lot of my documents and photos from OneDrive to my physical drive. I still haven’t come up to the conclusion on which privacy-oriented service to switch to. With that said, I am also having an argument with another individual who swears on Microsoft OneDrive’s security. Equating it to Tresorit’s security, for example. I am not a privacy veteran. I am quite new to this environment and I don’t know where to find the data or statistics to show him on OneDrive’s privacy/security. I would appreciate any leads about this question. Thanks ahead! --- ## Post 273 by @exaCORE — 2024-06-27T00:40:05Z Privacy guides has an entire page on cloud storage options --- ## Post 274 by @Zombie.Turtle — 2024-06-27T00:53:57Z That doesn’t answer my question I specifically asked for. > [@Zombie.Turtle](#): > > With that said, I am also having an argument with another individual who swears on Microsoft OneDrive’s security. Equating it to Tresorit’s security, for example. I am not a privacy veteran. I am quite new to this environment and I don’t know where to find the data or statistics to show him on OneDrive’s privacy/security. --- ## Post 275 by @exaCORE — 2024-06-27T01:16:30Z For Onedrive’s privacy, a good place to start would be their privacy policy (compared with Tresorit’s) --- ## Post 276 by @Zombie.Turtle — 2024-06-27T02:12:57Z You’re still not being helpful. I asked for data. Some form of history, statistics and analysis specifically for OneDrive. --- ## Post 277 by @olanography — 2024-06-27T03:56:54Z I think you should make a separate post about the second question instead. Although OneDrive is Windows-related, this post is about _Windows configurations_. The equestion is asking for specific information that IMO does not change OneDrive’s relationship to the guide’s configurations, therefore offtopic. (Although, if someone argues and shows that it does, then by all means ignore this.) Also, I think the admins should delete the off-topic responses here, including this one. --- ## Post 278 by @exaCORE — 2024-06-27T03:57:12Z I was suggesting a place that you could begin to help yourself answer your question rather than just relying on others. --- ## Post 279 by @dngray — 2024-06-27T03:59:48Z > [@Zombie.Turtle](#): > > I am also having an argument with another individual who swears on Microsoft OneDrive’s security. Equating it to Tresorit’s security, Well for a start Tresorit has E2EE (meaning they can’t read your files even if they wanted to) and One Drive does not. --- ## Post 280 by @Zombie.Turtle — 2024-06-27T06:27:30Z I would have, but from my understanding, the forums would like to stick to a single thread about topics that relate to relevant products. --- ## Post 281 by @sha123 — 2024-06-27T07:13:00Z It is neither the same topic nor the same product. Using a different thread makes sense. This one is already too long. --- ## Post 282 by @anon80779245 — 2024-06-27T12:10:31Z [tryhackme.com](http://tryhackme.com) “Windows fundmentals” rooms are very informative and talk about how Windows settings actually work, and at the end Bitlocker, The antivirus, etc… > **[Windows Fundamentals](https://tryhackme.com/module/windows-fundamentals)** > > Get hands-on access to Windows and it's security controls. These basics will help you in identifying, exploiting and defending Windows. --- ## Post 283 by @whoami5 — 2024-07-26T11:53:30Z > Recent versions of Windows, especially Windows 11, are widely considered to be the most privacy-invasive and least secure modern operating systems. Where is the citation for windows being the ‘least secure’ OS? > If you have the choice between Windows 10 and Windows 11, we would recommend using Windows 10 for as long as possible." Why shitting on windows 11 when it significantly increases security for all users by turning on security features by default? It turns on secure boot, tpm, credential guard, memory HVCI --- ## Post 284 by @sha123 — 2024-07-26T11:55:45Z Where are these quotes from? --- ## Post 285 by @whoami5 — 2024-07-26T11:56:43Z windows guide > **[Windows Overview - Privacy Guides](https://www.privacyguides.org/en/os/windows/)** > > Microsoft Windows is a common operating system which is extremely non-private out of the box. Our guide covers making some improvements to your computer without replacing your OS. --- ## Post 286 by @fria — 2024-07-26T11:57:30Z Yeah I don’t agree with that part. --- ## Post 287 by @anon80779245 — 2024-07-26T13:16:29Z > [@whoami5](#): > > Why shitting on windows 11 when it significantly increases security for all users by turning on security features by default W11is way more secure, so not sure why it is saif otherwose --- ## Post 288 by @redoomed1 — 2024-07-26T13:17:18Z Major changes have been made to that page and other Windows-related pages. The PR is already merged and should reflect on the live site whenever the next release happens: [https://github.com/privacyguides/privacyguides.org/pull/2606](https://github.com/privacyguides/privacyguides.org/pull/2606) --- ## Post 289 by @ave9858 — 2024-10-06T14:19:05Z Just noticed the Group policy section of the guide uses the Windows 11 names, on Windows 10 some of the names are different (ex “Allow Telemetry” instead of “Allow Diagnostic Data”). Also, Desktop Analytics seems like an enterprise feature not enabled by default so I’m not sure if there’s any point in touching settings related to it. --- ## Post 290 by @lepras — 2024-10-06T14:55:44Z > [@ave9858](#): > > Group policy btw whats the best UX for setting group policy objects? --- ## Post 291 by @ave9858 — 2024-10-06T15:02:26Z > [@lepras](#): > > btw whats the best UX for setting group policy objects? wdym best UX? i don’t see any reason not to just use the default editor --- ## Post 292 by @fria — 2024-10-06T17:52:01Z Windows 10 is about to go EOL next year so time to upgrade. --- ## Post 293 by @Average_Joe — 2024-10-07T10:46:32Z I want to stay with Win10 Pro as long as I can but eventually we’ll all be forced to upgrade October 2025. Are there any new security/user privacy to Win11 Pro compared to Win10 Pro? **There seems to be some confusion on when Win10 support ends so here’s an official Microsoft statement:** > **[End of support for Windows 10, Windows 8.1, and Windows 7 | Microsoft Windows](https://www.microsoft.com/en-us/windows/end-of-support)** > > Make a smooth transition to Windows 11 from your unsupported operating system with help from Microsoft. Enjoy the benefits of upgrading to a Windows 11 PC. --- ## Post 295 by @ikelatomig — 2024-10-07T12:48:27Z You can with Windows 10 IoT Enterprise LTSC till 2032. Don’t ask me how. Please search the web. --- ## Post 296 by @Viper — 2024-10-07T20:22:49Z My only gripe with this is the iso, i dont know where it came from even though i can verify the hash. So :person_shrugging: --- ## Post 297 by @crossroads — 2024-10-08T04:43:24Z There’s this tool to check it [https://www.majorgeeks.com/files/details/windows\_and\_office\_genuine\_iso\_verifier.html](https://www.majorgeeks.com/files/details/windows_and_office_genuine_iso_verifier.html) --- ## Post 298 by @ave9858 — 2024-10-08T19:22:42Z And why would you trust that tool? Better to verify the hash against multiple databases instead of running random code on your own device. It is also possible to verify the hash directly from Microsoft --- ## Post 299 by @ave9858 — 2024-10-08T20:11:30Z > [@Viper](#): > > My only gripe with this is the iso, i dont know where it came from even though i can verify the hash. So :person_shrugging: It came from Microsoft, specifically MVS, but it can also be downloaded from VLSC if you have a license for that. --- ## Post 300 by @Viper — 2024-10-09T03:25:38Z I might dm you if your ok with that. Just give me some time to gather my thoughts/resources. Tx --- ## Post 301 by @takama — 2024-11-30T12:02:39Z Is the former overviews not accessible anymore? I remember setting up my windows enterprise multiple times using the guide on PG site but can’t find it anymore. Instead there’s this unfinished one and github where I can’t find simple step by step tutorial. What do I do now then? --- ## Post 302 by @anon80779245 — 2024-11-30T17:24:52Z It is now on the main website [Windows Overview - Privacy Guides](https://www.privacyguides.org/en/os/windows/) --- ## Post 303 by @takama — 2024-11-30T18:57:11Z Yeah all those coming soon topics were covered in overview, so can’t I access it anymore? --- ## Post 304 by @anon80779245 — 2024-11-30T19:02:50Z They are not here [Group Policy Settings - Privacy Guides](https://www.privacyguides.org/en/os/windows/group-policies/) ? --- ## Post 305 by @takama — 2024-11-30T22:10:56Z This is but a fraction of what it used to be --- ## Post 306 by @anon501347810 — 2024-12-04T19:11:34Z I believe this is what you are talking about: > **[Windows Overview - Privacy Guides](https://web.archive.org/web/20230716133118/https://deploy-preview-1659--privacyguides.netlify.app/windows/overview/)** > > Privacy Guides is your central privacy and security resource to protect yourself online. --- ## Post 307 by @Torsten — 2024-12-11T02:49:19Z Update: by enabling “advanced mode” in UBlockOrigin I was able to ditch NoScript! I use UBO purely now, it is great --- ## Post 308 by @Torsten — 2024-12-11T02:51:51Z Source? Process isolation with nested filesystem userns sandboxes works in podman containers. With gVisor you can harden apps even more by reducing the attack surface they are exposed to --- ## Post 309 by @PixelatedWizard — 2024-12-26T15:52:55Z I’m bit perplexed by the “Platform Security Level: Secure Boot and DMA Protection” setting suggested in the [group policy page](https://www.privacyguides.org/en/os/windows/group-policies/) because my understanding is that most Desktop PCs/CPUs don’t support DMA protection? If I set this setting is there potential for some problems to arise? I’m also wondering about the Device Guard setting and how to know if my CPU (Ryzen 7600) would support it and if turning it on could again have some potential problems if not. --- ## Post 310 by @Sprout3425 — 2024-12-27T01:32:49Z Hardening Windows is way too complicated for the average user, so they have two options: 1. To use Linux where possible, otherwise the easiest and safest way (recommended by Microsoft themselves) to debloat and make more private Windows should be at _the top_ of the guide. That would be to use Windows Education (since it disables some telemetry by default and other unnecessary features like Cortana) via a MAS, and then fresh installing it after, or are there even more private, debloating and easier ways? Then we can follow this up with how to encrypt Windows etc. --- ## Post 311 by @anon29374801 — 2024-12-27T15:43:48Z > [@Sprout3425](#): > > Hardening Windows is way too complicated for the average user This is why a guide is being made. > [@Sprout3425](#): > > two options: 1. To use Linux where possible Telling someone not to use Windows, in a Windows guide. This can’t be a serious suggestion. --- ## Post 312 by @Sprout3425 — 2024-12-28T00:32:24Z Well it is, a lot of people do not know that Linux can be feasible for everyday people and professionals, including myself. If I am wrong, then Linux kinda stinks. --- ## Post 313 by @asanyan — 2024-12-28T01:39:18Z I still think that it would be much better to simply recommend a 1-click powershell script that changed all the “bad” settings to good ones. --- ## Post 314 by @AverageWindowsUser — 2025-01-07T02:49:33Z Hello everyone, the group policy page was good, but unfortunately, there’s an issue. People using the home edition of Windows don’t have the group policy editor, but they do have the Registry Editor. So is it possible to add the regedit keys associated with these group policies to the page. You can find the regedit keys and values associated with the group policies using website like [https://gpsearch.azurewebsites.net/](https://gpsearch.azurewebsites.net/) or [https://admx.help/](https://admx.help/) . Thanks. --- ## Post 315 by @win11.shading291 — 2025-01-07T16:58:00Z You can also use this tool: > **[privacy.sexy - Maximize Your Privacy and Security](https://privacy.sexy/)** > > Discover privacy.sexy, the privacy tool to maximize your privacy and security on Windows, macOS, and Linux. Easily use best practices to prevent tracking and make your life secure and private — because privacy is sexy. --- ## Post 316 by @anon29374801 — 2025-01-07T17:01:44Z > [@asanyan](#): > > simply recommend a 1-click powershell script that changed all the “bad” settings to good ones. I would caution against doing this if you don’t understand what that script is doing. It is really easy to end up locking yourself out of things (especially if you use one that adds all the microsoft security baseline rules) you may want and spending a ton of time figuring out what setting was changed that caused the issue. All of a sudden you are googling how to fix ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/6/60c5f80ea9ae483d03b25c2daff56872627fed32.png) blindly running a script, especially to make system level changes, is the opposite of good security practices. --- ## Post 317 by @asanyan — 2025-01-07T17:25:00Z Sure. I was thinking about privacy tweaks specifically, things that everyone here would want i.e. no web search in start menu, disabled telemetry, etc. --- ## Post 318 by @Julie — 2025-01-07T19:25:04Z What not start by using Windows LTSC IOT ? You could also make your own private windows version with nlite (or another similar tool). --- ## Post 319 by @anon56653282 — 2025-01-07T20:50:40Z > [@win11.shading291](#): > > You can also use this tool: > > [https://privacy.sexy/](https://privacy.sexy/) No. Never use third-party “anti-spying”/“privacy hardening” tools. Use official documentation from Microsoft only and follow Microsoft best practices. Using third-party tools increases your attack surface, requires you to trust the developers of the tool, is not needed to disable all telemetry in Windows, and can break your system. Recommended guide: > **[Harden Windows Security](https://hotcakex.github.io/)** > > Harden Windows safely, securely using Official Microsoft methods --- ## Post 320 by @Bhaelros — 2025-01-07T21:01:35Z Did you even check the website? --- ## Post 321 by @anon29374801 — 2025-01-07T21:37:01Z > [@Julie](#): > > What not start by using Windows LTSC IOT The dev of [https://hotcakex.github.io](https://hotcakex.github.io) put this [really well.](https://github.com/HotCakeX/Harden-Windows-Security/discussions/265#discussioncomment-9604306) > LTSC is the platform for no updates ever. LTSC is for devices where you install the OS and don’t plan on touching it for the next 10 years. > > It’s true that LTSC has a lot of its components stripped out, but that also means many of the security features are also unavailable. **The security features in the normal edition of the OS decrease the attack surface more than anything LTSC has to offer.** > > Normal editions of the OS have policy for everything, most components can be configured or removed using policies, Intune CSPs etc. People trying to use this guide with an LTSC or LTSB version are going to run into issues where they do not have the options specified in the guide. --- ## Post 322 by @Julie — 2025-01-08T01:35:39Z That false information. Stating no updated ever it not true. I already had updates, there security updates for 10 years, just no FEATURES updates. I read your second link and the other himself stated : > _Security features aren’t backported to LTSC AFAIK._ So he admit that now, there no security features missing from Windows11 LTSC --- ## Post 323 by @asanyan — 2025-01-08T02:24:15Z Windows 10 IoT Enterprise LTSC 2021 will receive security updates until 2032, 7 years longer than regular versions of W10. --- ## Post 324 by @anon29374801 — 2025-01-08T03:39:23Z > [@Julie](#): > > That false information. Stating no updated ever it not true. > [@Julie](#): > > just no FEATURES updates. This is how I understood it was meant considering the context of the thread. > [@anon29374801](#): > > People trying to use this guide with an LTSC or LTSB version are going to run into issues where they do not have the options specified in the guide. Anyway AFAIK this still holds true. There are not the same policy options included in these versions so it would be counter productive to this guide to recommend them. Especially since the average home user is unlikely to be able to get these versions legitimately. [Here](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102/25) is just a small example of that occurring > [@Instructions on Hardening Windows (What I Have Learnt So Far)](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102/17): > > Also a bit confusing that in GPO it states > > ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/8/8c7f89c534afa804507d570e091354999406284d.png) > > But if you got to the microsoft page about [attack surface reduction](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#group-policy) 6 (warn) is also an option. --- ## Post 325 by @anon54690201 — 2025-01-08T14:08:01Z Has anyone used the hotcakex script yet? I see they have recommended or basic presets. I am unsure what to use because i would also like to use portmaster. Or is that a no-no? --- ## Post 326 by @faxe — 2025-01-08T15:09:00Z I didn’t use the script, but I used the page and other hardening guides (for example beerisgood, german bsi and troennes private-secure-windows among others) alongside the official windows documentation to harden my system since I wanted to do it the proper way instead of some downloaded script. --- ## Post 327 by @anon54690201 — 2025-01-08T15:18:48Z > [@faxe](#): > > troennes private-secure-windows Oh, for sure. Do you think one must have to worry about the script even though she is claiming it’s all done through official Microsoft tools? --- ## Post 328 by @faxe — 2025-01-08T15:29:10Z As said before I only used it as inspiration and didn’t use the script. IMHO you should at least check what the script changes before running it, to avoid being surprised by some kind of “this action has been blocked by your administrator” screen or your windows installation behaving different from what you expect (in regards to bitlocker, controlled folder access, etc.). Also note that it hasn’t been upgraded to the official 24H2 security baselines. There is also [this thread](https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102) which has many valuable pieces of information. --- ## Post 329 by @anon54690201 — 2025-01-08T18:35:34Z That makes sense. Thanks for the tip! --- ## Post 330 by @ave9858 — 2025-01-10T22:32:48Z HotcakeX actually reduces security: ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/5/522bdcab10c5d693b4d2925464322c8775c3c3f4.png) Hyper-V admin to full admin is [not a security boundary](https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria), meaning that a technique that allows Hyper-V admins to elevate to administrator will not be considered a security issue and therefore won’t be quickly patched if patched at all. HotcakeX gives this permission to all standard users, essentially giving every user on the machine administrator permissions by default, which is the complete opposite of what a “hardening” script should be doing. The script also enables many options that can reduce privacy, I really don’t see any reason for anyone to use it. These sorts of scripts should always be avoided, privacy.sexy has similar problems where it changes settings for no reason in ways that can cause breakage even when there’s no privacy impact. --- ## Post 331 by @anon54690201 — 2025-01-10T22:47:33Z What would you recommend as an alternative? --- ## Post 332 by @ave9858 — 2025-01-10T22:57:29Z flipping settings manually, you don’t really need to be changing so many settings at all. for privacy, disable telemetry, error reporting, and don’t sign in with a microsoft account and you should be mostly good. for security, just do some defender hardening and read thru the microsoft security baselines and enable settings that are both relevant on a non-enterprise machine and also aren’t enabled by default (there aren’t many of these settings) --- ## Post 333 by @anon54690201 — 2025-01-10T23:03:26Z I did not notice with hotcakes script you can pick and choose different sections. Would it make sense to do the Microsoft baselines category? I also see that bitlocker is configured to the max. --- ## Post 334 by @ave9858 — 2025-01-10T23:06:27Z i wouldn’t use any sort of third-party script, microsoft already has a script for applying their security baselines, though most of the settings there are geared towards business usecases. applying all the settings there will just cause unnecessary breakage, with many settings having little to no security gain outside a business environment --- ## Post 335 by @anon54690201 — 2025-01-10T23:13:57Z Oh for sure. Very new to this so thank you for the insight! --- ## Post 336 by @user1 — 2025-01-11T11:07:26Z Frankly I find that hardening privacy on Windows manually is overwhelmingly complex and unpractical to manage for the average user. Also many settings can be reverted after system updates and you can’t review all of them every month. Privacy.sexy is nice and open source, has infos about what a setting is doing but it can’t detect which settings are already applied so you don’t have any overview of your current state. I finally decided to trust a third party app [O&O ShutUp10](https://www.oo-software.com/en/shutup10) to be able to apply and keep track of privacy settings and I’ve never had any problem. The app clearly shows which settings are applied, which one are not recommended and could cause breakage and provides infos for every single item. Also prompts for a backup restore point before applying changes. The software is not open source but devs are an official Microsoft Partner so that gives me some kind of trust about quality of code. It is simple, reliable, portable, actively updated and it just works. --- ## Post 337 by @anon54690201 — 2025-01-11T14:30:53Z Oh that’s cool! Is it weird they are endorsed my microsoft? --- ## Post 338 by @overdrawn98901 — 2025-01-11T14:42:11Z They’ve got a lot of other products available, so I would say it isn’t weird. --- ## Post 339 by @anon54690201 — 2025-01-11T15:43:45Z Oh for sure --- ## Post 340 by @PixelatedWizard — 2025-01-15T20:33:27Z Does it make any difference security features wise if you install browser from the Microsoft Store or just as .exe? And is there any privacy trade off? --- ## Post 341 by @win11.shading291 — 2025-01-20T18:32:01Z Privacy.sexy is definitely not a finished product, but I feel like it is the most transparent. I run it every time there is an update (I ran it 3 times in the past 7 months). When there are updates, I compare the oldscript to the new one to see what changed. So it is time consuming, but I didn’t encounter any breakages. I use the “strict” options. then remove some of the options (for instance, the script removes Windows Defender, but I use it, so I remove some of the Windows Defender options). I had a list of what I add and remove form the strict options but I lost it because of a Only Office bug… I could post it if it helps anyone, but it wont be until about 2-3 more months because I just ran the script this week. If anyone interest, please let me know. --- ## Post 342 by @asanyan — 2025-02-28T13:21:48Z Reviving this thread to ask, is there a way to reliably trick software that demands high privileges in Windows? Saw this `Disable "Always install with elevated privileges" in Windows Installer` in privacy.sexy but I assume it’s only for MSI installers. Many programs require elevation just so that they can install to `C:\Program Files` though that is unnecessary for most setups and is a security risk. --- ## Post 343 by @Average_Joe — 2025-03-05T18:32:36Z > [@asanyan](#): > > Reviving this thread to ask, is there a way to reliably trick software that demands high privileges in Windows? I still think this is a great idea for those of us that NEED access to a secure Microsoft Windows Pro PC that’s running a 100% legitimate version. **I know it’s possible to install “pirated” versions of Windows but I have no intention of doing this as these “pirated versions” are often loaded with backdoor trojans by the person who uploaded it.** --- ## Post 344 by @ave9858 — 2025-03-06T21:58:09Z try setting the env var `__COMPAT_LAYER=RUNASINVOKER` --- ## Post 345 by @win11.shading291 — 2025-04-03T03:58:25Z > [@win11.shading291](#): > > I had a list of what I add and remove form the strict options but I lost it because of a Only Office bug… I could post it if it helps anyone, but it wont be until about 2-3 more months because I just ran the script this week. If anyone interest, please let me know. Ok so here it is. **DISCLAIMER** _I am not an expert and based all the decisions on the information provided in the privacy.sexy program on my own judgement. I STRONGLY advise to read each and everyone one of the option if you want to use the “STRICT” option. Also, because everyone uses different programs. For example, the strict option removes some Windows Defender and Windows Update stuff that might not be desired, especially in the “privacy over security” section. For instance, I disabled the automatic driver updates, because I have NVinstall and update the rest via other means then Windows Update. Again, even if it takes about 2 hours to go through the options, it is necessary if you go ahead with the privacy.sexy strict option._ Here’s what I did (Windows 11 Home) and I didn’t encounter any breakage. **REMOVE FROM ‘STRICT’** ``` * Clear Quick Access recent files * Remove "Network Connectivity Status Indicator (NCSI)" app (breaks internet connection status icon) * Disable Defender Antivirus "Block at First Sight" feature * Disable Defender Antivirus real-time security intelligence updates * Disable Defender Antivirus Azure data collection * Disable automatically enabling Windows Update Medic Service * Disable Windows Push Notification ``` **ADD TO ‘STRICT’** _ **Privacy Cleanup** _ ``` * Clear thumbnail cache * Clear event logs in Event Viewer application * Clear credentials in Windows Credential Manager * Empty trash (Recycle Bin) * Clear volume backups (shadow copies) * Clear previous Windows installations ``` _ **Disable OS Data Collection** _ ``` * Disable "Diagnostics Hub Standard Collector" service * Disable Windows Location Provider * Remove "Windows Insider Program" from Settings ``` _ **Configure Programs** _ ``` * Disable "NVIDIA telemetry monitor" task * Disable "Nvidia Telemetry Container" service * Disable Visual Studio Code Data Collection * Configure Browsers (check all + remove Firefox) ``` _ **Security Improvements** _ ``` * Improve Network Security (validate all manually to make sure) * Enable protection against Meltdown and Spectre ``` _ **Block tracking hosts** _ `* Block Spotify Live Tile hosts` _ **Privacy Over Security** _ `* Disable SmartScreen in Microsoft browsers` _ **UI for Privacy** _ ``` * Remove folders from This PC in File Explorer * Disable recent apps ``` _ **Remove Bloatware** _ ``` * Remove 3D Modeling apps * Remove extension apps * Remove Microsoft Office Apps * Remove Microsoft Store Apps * Remove third-party apps * Remove "Contact Support" app * Remove "App Installer" app * Remove "Microsoft Tips" App * Remove "Microsoft Messenging" App * Remove "Mixed Reality Portal" App * Remove "Windows Alarms and Clock" App * Remove "Windows Camera" app * Remove "Paint 3D" app * Remove "Microsoft People" app * Remove "Microsoft Pay" app * Remove "Mobile Plans" app * Remove "Microsoft Solitaire Collection" app * Remove "Microsoft Sticky Notes" app * Remove "Windows Media Player" app * Remove "Movies & TV" app * Remove "Microsoft Photos" app * Remove "Skype" app * Remove "GroupMe" app * Remove "Windows Sound Recorder" app * Remove "Microsoft Remote Desktop" app * Remove "Microsoft To Do: Lists, Tasks & Reminders" app * Remove "Edge" * Remove "Xbox" * Disable "Direct Play" feature * Disable "Internet Explorer" feature * Disable "Legacy Components" feature * Disable "Windows Media Player" feature * Remove "Internet Explorer 11" capability * Disable User Data Access ``` --- ## Post 346 by @KevPham — 2025-04-03T16:02:41Z [https://www.ghacks.net/2025/04/03/microsofts-windows-10-end-of-support-checklist-has-more-holes-than-swiss-cheese/](https://www.ghacks.net/2025/04/03/microsofts-windows-10-end-of-support-checklist-has-more-holes-than-swiss-cheese/) With Windows 10 being end-of-life, we should probably ensure that this guide is tailored to Windows 11. --- ## Post 347 by @anon39279085 — 2025-04-03T16:07:07Z or if the user somehow decides to use unconventional means to keep windows 10 alive we can stick to that, until 2032 (whenever thorough IoT LTSC or ESU) to my understanding however yeah it would be generally a good idea to stick to 11 --- ## Post 348 by @anon44905022 — 2025-04-12T06:52:06Z Is there going to be more details in the Windows section on the Privacyguides website? I am sorry but i am a tech noob and do not know where to find current development. I plan to install Windows on a few computers that is why i am asking. :slight_smile: --- ## Post 349 by @anon73250778 — 2025-04-12T10:13:11Z Hi welcome! I think the general consensus these days is to let Windows run up to date either bare metal or in a virtual machine and just isolate it in your home network in its VLAN or a dedicated network. Do the things you need for specifically _ **and nothing else** _ - Office work specifically needing MS Office - Online Competitive Multiplayer - CAD work (AutoCAD) - Photoshop - etc Even better if you can spare each of the use above with a specific machine, specific virtual machine or at the very least, a separate non-admin local user account (if you cannot do VMs or dont have spare PCs). Keep the rest of your computing in a separate Linux machine for general browsing, email, desktop versions of various chat software, and other general desktop usage. --- ## Post 350 by @Microsoftedgeuser — 2025-04-12T10:56:59Z > You can try this guide --- ## Post 351 by @anon54690201 — 2025-04-12T21:19:11Z Can any of those powershell commands break the system? --- ## Post 352 by @anon44905022 — 2025-04-13T03:23:53Z I have a desktop PC. If i install Windows 11 on a second SSD on the same PC, the first ssd being linux. Is that safe to do? --- ## Post 353 by @anon73250778 — 2025-04-13T03:27:25Z Yes for the most part. Its kind of annoying to swap SSDs though if you intend to daily drive it. You are still vulnerable to UEFI level malware but those are rare. --- ## Post 354 by @asanyan — 2025-04-13T14:05:13Z Just use chris titus’s winutil and/or privacy.sexy. No point in doing all that manual work with group policy/registry when people have already done it for you --- ## Post 355 by @anonymous261 — 2025-04-13T14:57:59Z As I recall (no, not that way), GrapheneOS has stated they will be working on Windows VMs in GrapheneOS. If this feature gets implemented, it could complement the rumored Android Laptop and threaten to make Windows obselete. --- ## Post 356 by @anon73250778 — 2025-04-14T00:54:03Z > [@anonymous261](#): > > Windows obselete. This has already happened. Check out how websites are designed these days. Desktop has been overtaken by mobile long ago. There are far more people with phones than PCs these days. Gaming is also more common on mobile these days. It doesn’t help that console has also become more mobile and are going to the direction of portability due to the success of Steam Deck. --- ## Post 357 by @Microsoftedgeuser — 2025-04-14T09:12:04Z Imas long as you don’t use those services [https://raw.githubusercontent.com/hagezi/dns-blocklists/main/hosts/native.winoffice.txt](https://raw.githubusercontent.com/hagezi/dns-blocklists/main/hosts/native.winoffice.txt) --- ## Post 358 by @mika — 2025-04-14T14:09:25Z Windows is not obsolete and will not become obsolete in the foreseeable future. There are lots of mission-critical pieces of hardware and software for many different use cases that only run on Windows (or Windows and Mac). As far as I know there is no 100% compatible and reliable way to run Windows software in Linux. Maybe someday (performance penalties also need to be reduced). Therefore there is still a need for Windows recommendations. --- ## Post 360 by @KevPham — 2025-04-14T17:30:08Z We are currently working on a [Windows guide](https://www.privacyguides.org/en/os/windows/) that focuses mostly on harm reduction. As you can see here, it is incomplete as of today. Only the “Group Policy” section is compelete. This is more of an internal discussion among the PG team, but I am always happy to personally contribute to the Windows section during my spare time. However, I am also working on a few other projects related to site development. Edit: Is there a specific guide on Windows that you would prefer seeing first? Installation is the easiest to write IMO but I’m sure that you would probably prefer a more complete guide up-front lol --- ## Post 361 by @anon73250778 — 2025-04-15T00:47:36Z > [@KevPham](#): > > it is incomplete as of today. It will never be complete as Windows like to thrash itself around after a Windows update (that happens every first tuesday of the month, btw) and reset your setting to whatever it wants to be. It also reinstalls your Candy Crush Cola just in case you changed your mind and like it now more. This happened because Windows have become so adversarial and so anti-user. Me, I have given up. Windows is on permanent detention at home. I have a laptop machine that runs Windows should I ever have a need for it (thankfully I dont). It is connected to the LAN port provided by the ISP and never touches the insides of the home network. --- ## Post 362 by @anon44905022 — 2025-04-15T02:00:34Z > [@KevPham](#): > > Is there a specific guide on Windows that you would prefer seeing first? My family runs a small business with a few computers. We are too small to hire an IT firm so i have to configure the computers. I already have hardened them. What i personally i am looking for are tips to increase the security of the OS. I already know how to increase privacy as much as possible but not too much about the security. I have also done some things for security but i am not an expert and do not know if i have missed something important. The employees using those computers are opening files from email all day (invoices, offers, etc). So the threat model is opening malicious files. --- ## Post 363 by @win11.shading291 — 2025-04-15T03:09:20Z > [@anon73250778](#): > > It will never be complete as Windows like to thrash itself around after a Windows update (that happens every first tuesday of the month, btw) and reset your setting to whatever it wants to be. It also reinstalls your Candy Crush Cola just in case you changed your mind and like it now more. This happened because Windows have become so adversarial and so anti-user. Yep, it’s not great. Unfortunately, as long as businesses run on Windows, it won’t be going anywhere anytime soon. My solution to that issue is that every couple of months, I run the privacy.sexy script that I configured to my needs after a Windows Update. It’s annoying, but it only takes 15 minutes (once you’ve done the first run). > [@anon44905022](#): > > I already know how to increase privacy as much as possible but not too much about the security. If I can echo what I’ve read here, Windows is pretty secure combined with Windows Firewall. It’s really the privacy that is the issue. --- ## Post 364 by @sha123 — 2025-04-15T09:52:31Z Apply Windows and MS Office security baselines. You might want to check for privacy invasive settings in these and adjust them. Let users only have access to non-admin accounts and encourage everyone to use Windows Hello for authentication. Block execution of untrusted software from user-writable locations with Applocker. All of these measures should require rather low maintenance, once adjusted to your needs. Update to a newer version of the baselines every now and then. You might also want to block unsigned script execution. If you want extra safety, have a look into WDAC, but this is definitely more effort to maintain. --- ## Post 365 by @KevPham — 2025-04-21T21:08:25Z > [@anon44905022](#): > > My family runs a small business with a few computers. We are too small to hire an IT firm so i have to configure the computers. I already have hardened them. What i personally i am looking for are tips to increase the security of the OS. I already know how to increase privacy as much as possible but not too much about the security. Noted! We will look into this. Thanks for sharing --- ## Post 366 by @anon54690201 — 2025-05-03T10:38:26Z I would love a complete guide up front! Haha! Not trying to sound pushy but does PG have an idea when some of the other guides will be available? Thanks for all you do! --- ## Post 367 by @Bhaelros — 2025-05-03T11:38:43Z Considering you are already using MS products, what about you switch to M365 Business Premium and manage all the computers from cloud via Intune? It also has security baselines in it, so it will be easy to manage. > **[Learn about Intune security baselines for Windows devices](https://learn.microsoft.com/en-us/intune/intune-service/protect/security-baselines)** > > Deploy security baselines that have preset and recommended configurations to the Windows devices you manage with Microsoft Intune. You can also add Defender and compliance policies to the endpoints, manage software installations, add web filtering, etc. --- ## Post 369 by @KevPham — 2025-05-06T16:14:49Z Most likely over the summer. A lot of research has been done by the community already, but we haven’t formally published anything on our end yet. If you’re interested in these community guides, we may launch a new Community Wiki section in the near-future. Windows-related guides can appear here as a placeholder for the official guide. Note that these guides are not officially endorsed by Privacy Guides; however, we will consider all feedback from the community. --- ## Post 370 by @jonah — 2025-05-06T19:55:56Z **There are a number of community-written Windows guides now published here:** [https://discuss.privacyguides.net/tags/c/community-wiki/9411/windows](https://discuss.privacyguides.net/tags/c/community-wiki/9411/windows) * * * This is how we are going to move forward: 1. If you have a problem with or suggestion for one of the community-written guides at the link above, please reply directly to that guide (or [edit it yourself](https://discuss.privacyguides.net/t/community-wiki-index/27332)). 2. If you want to contribute information about Windows that hasn’t already been covered, feel free to write a new guide in the #Community Wiki ([more info](https://discuss.privacyguides.net/t/community-submitted-wiki-guides-section/27328)) 3. If you have a question about Windows which hasn’t already been covered, you are of course always free to ask in #privacy:questions. _In the meantime_, we are going to work on a Windows section for privacyguides.org that will likely incorporate much of the information in the guides linked above, as well as the discussion that has taken place here up until now. There will be a PR on GitHub for this soon. Because there are now many areas where further discussion will be more appropriate, I am going to lock this _general_ thread. It’s become a bit of an unsearchable catch-all about Windows, so continuing the discussions that have been happening here in one of the three areas mentioned above will be the best approach :+1: --- ## Post 371 by @jonah — 2025-05-06T19:56:00Z Locked as #invalid because there exist more specific threads to discuss these changes. (see above)