# Windows Guide

**URL:** https://discuss.privacyguides.net/t/windows-guide/250
**Category:** Guide Suggestions
**Tags:** invalid
**Created:** 2022-10-05T04:48:05Z
**Posts:** 370
**Showing post:** 157 of 370

## Post 157 by @anon34108895 — 2023-12-29T07:13:00Z

There are some additional suggestions. Currently I donot have a github account so I cannot submit a pr.

1. use a [secured-core](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) devices with timely firmware support. my personal reccomendation is [surface for business](https://www.microsoft.com/en-us/surface/business) series.
2. turn on [Smart App Control](https://support.microsoft.com/en-au/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003). if you have privacy concerns, skip this and use [WDAC](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard) instead.
3. [configure](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/configure?tabs=common) Bitlocker to use TPM+PIN, long PIN length and 256 bit encryption
4. [Disable](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-microsoft-accounts#restrict-the-use-of-microsoft-accounts) Microsoft account
5. only update drivers through Windows Update or official websites. avoid softwares like Geforce Now
6. [do not show](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) username on lock screen
7. use [yubikey](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide) as local account 2FA method
8. turn off these telemetry.[1](https://learn.microsoft.com/en-us/dotnet/core/tools/telemetry#how-to-opt-out) [2](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry?view=powershell-7.4#:~:text=To%20opt%2Dout%20of%20this%20telemetry%2C%20set%20the%20environment%20variable%20%24env%3APOWERSHELL_TELEMETRY_OPTOUT%20to%20true%2C%20yes%2C%20or%201.) [3](https://learn.microsoft.com/en-us/microsoft-edge/webdriver-chromium/?tabs=c-sharp#opt-out-of-diagnostic-data-collection)
9. enable [complete mitigations](https://support.microsoft.com/en-us/topic/kb4073119-windows-client-guidance-for-it-pros-to-protect-against-silicon-based-microarchitectural-and-speculative-execution-side-channel-vulnerabilities-35820a8a-ae13-1299-88cc-357f104f5b11#:~:text=that%20are%20running.-,Registry%20settings,-We%20provide%C2%A0the) for side channel attacks. also [this](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/cve-2017-5715-and-hyper-v-vms#ensure-hyper-v-is-configured-to-expose-new-processor-capabilities-to-guest-virtual-machines)
10. these settings to improve security. [1](https://www.microsoft.com/en-us/security/blog/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/#:~:text=How%20to%20enable%20sandboxing%20for%20Windows%20Defender%20Antivirus%20today) [2](https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#enforce-local-account-restrictions-for-remote-access) [3](https://learn.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard?tabs=gpo#enable-delegation-of-nonexportable-credentials-on-the-remote-hosts) [4](https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN#suggested-actions) [5](https://support.microsoft.com/en-us/topic/kb5032314-how-to-manage-the-ole-object-conversion-vulnerability-associated-with-cve-2023-36563-98d95ae9-2f9e-4f65-9231-46363c31cf07#:~:text=If%20you%20have%20applications%20in%20your%20environment%20that%20are%20at%20risk%20of%20this%20vulnerability%2C%20follow%20these%20steps%20to%20mitigate%20the%20vulnerability)

---

_[View the full topic](https://discuss.privacyguides.net/t/windows-guide/250)._