Windows hardening?

Curious

Hi,

I am sorry for Off Topic but... recarding to security and privacy and the fact that some people use this system as daily driver on their PC I am curious about it.
(Let's accept the fact that Windows is privacy invasive system)

Now are there any detailed guides how to make Win hardened for pepople who do lot of stuff on it like gaming, accounts operations, maybe banking and generally have a good common sense and not download and install shady stuff, maybe just some open-source tools for daily workload?

What browser would be the best?
I know Brave is great in terms of balance between privacy and security, but isn't Edge just better in security due to integration (Smartscreen) with MS Defender increase security againts downloaded files and visiting those sites etc.?

Speaking of the devil, do you think that MS Defender is decent option for a person like that (and maybe use also Virus Total if something is sus) or 3rd party AV is still way to go? (Which one? Eset? Bitdefender? Have to say that those comes with extention for safe browsing which is basicly smart up like Edge has with MS Defender, I think this is kinda handy for situation you are on your guard but some random picture you are interested in detail and the it send you to some random web and it gets blocked by your AV)

Obviously Telemetry in Windows is not plesant really and to like trim it down is a tidious process but it is doable to some degree to make OS lean but... it is with lot of things that can actually break stuff and make some functionality not working.

Please try to avoid suggestion like go for Linux, Mac etc. that is not helpful really in this problem.
Thank you

WestQuester

Curious Please try to avoid suggestion like go for Linux, Mac etc. that is not helpful really in this problem.

............................aw man!

Meatheadmarty

Curious Please try to avoid suggestion like go for Linux, Mac etc. that is not helpful really in this problem.
Thank you

Use Qubes, a Xen hpervisor (which is not really Linux) and then create a stand alone Windws VM. Route the neworking of the Windows VM through sys-win-firewall and list any specific IP addresses that you must use as allowed but all other blocked by default and then route sys-win-firewall to sys-whonix. Also when using Wndows, assume that an AI agent is monitoring everything you do and sending it to Microsoft for analysis, even if the feature seems "off" and that the software will try to exploit any security weaknesses to send data out. Assume after any updates that Microsoft will "accidentally" turn on this feature witbout telling you and then record everything you do and try to send logs to Microsoft. Also set up wireshark on the sys-win-firewall to capture packets to analyze any ways Windows might try to exploit system vulnerabilities. Use openbsd for the template for sys-win-firewall since you are uncomfortable with linux. Do not touch dom0 or sys-whonix since you are uncomfortable with linux. Also clone the VM as "temp Windows" before using and then destroy "temp Windows" after each use.

trilogy6202

Curious Have you read PrivacyGuides guide on windows hardening?

Choosing the right version of Windows (Pro or Enterprise) and following their guide on hardening through group policies will get you quite far without breaking too much stuff.

https://www.privacyguides.org/en/os/windows/

https://www.privacyguides.org/en/os/windows/group-policies/

If you want to take things a bit further this guide from their forum might be of interest.

https://discuss.privacyguides.net/t/instructions-on-hardening-windows-what-i-have-learnt-so-far/16102

I would advise against installing tools to automate the process unless you really trust the people behind it.

Curious

WestQuester Yep, I know many, many people are like this... sorry, this option is not open :)

LeslieFH

You could run whonix on Windows. This will be much more secure (and also much less convenient) than running a browser directly on Windows.

userofgos

Privacy.sexy may be of interest. It's an open-source tool to enforce privacy & security best-practices on Windows and macOS. Github: https://github.com/undergroundwires/privacy.sexy.

freezet

There are some guides on github for hardening windows. Here is an example https://github.com/beerisgood/Windows11_Hardening , there are also a lot of tools for automating these things. Did not have the will and time to try it out.

Curious

freezet Wow this for the first time looks actually like something that make sense from the bottom to top.
I knew there are lots of things that you can do on Windows without any 3rd party stuff but those things are often hidden or non-easy to set up.
But I am not sure, like Edge vs Brave, I mean you can use both for sure, but... leaving Edge on system enables the most controversal thing in system and that is copilot and recall + massive telemetry vector.
But yea this guide seems really promising.

DeletedUser433

freezet I wonder why it says LibreOffice is insecure, I'll check the link on 7-zip later

wuseman

Check out Windows Sandbox and run your browser in that. Or use Edge in Application Guard.

indigomadelin

wuseman Edge in Application Guard

Microsoft Defender Application Guard, including the Windows Isolated App Launcher APIs, is deprecated for Microsoft Edge for Business and will no longer be updated. Starting with Windows 11, version 24H2, Microsoft Defender Application Guard, including the Windows Isolated App Launcher APIs, is no longer available.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard

Curious

wuseman sanbox looks cool but it requires virtualization on bios level which I think it is not so common on normal MoBos.

neotux

Curious

If you feel like to, you could use NTLite: https://www.ntlite.com/ to build your own streamlined Windows ISO.

wuseman

Curious How so? I'm running it at home on my 9 year old piece of junk.

oci3o

"Curious" #p172978 look for a guy on YouTube called Sami Laiho, he's a Windows Security MVP focusing on concepts not tools.
That's all you need 90% of the time, Windows isn't expensive to secure, just time-consuming without Group Policy or AAD.

Curious

Meatheadmarty Thank you for tip I saw Qubes but my point was not that I am not confy with Linux, point is that in this case using different OS is not a solution, Idk, imagine that there is no other OS, don't get me wrong, Linux and others have their pros really but also const, for example they sucks a lot in combatibility on lot of stuff like games etc. (yes you can game on linux, but... at that point to solve stuff when it is broken, one rather would not have computer at all, so annyoing to deal with and most of the time there is no real solution, if the overall compatibility would improve then yes, would be cool to use linux as general system, also Linux is not a safer than Windows, it has its own issues and the fact that people even don't know they exists). About that AI agent (I assume Recal, Copilot) you can rip them off the system and prove it is not there permanently.

Meatheadmarty

Curious There is no hardening of Windows, it's like making sugar taste less sweet.

Curious

trilogy6202 Will check out, ty

DeletedUser433 I wonder too, like what is the alternative if you do not want to use MS Office, he stated in guide, but I think it has something to do with this:
https://cybersecuritynews.com/libreoffice-vulnerability-arbitrary-script/

there was also and expoit on 7-zip
https://gbhackers.com/7-zip-vulnerability-3/

but I am not sure what else to use then, like sure I can do stuff on notepad :) but sometimes I need to a little bit more :D and online tools like Google docs are first of all online and second of all not so good at doing some specific things.

Curious

wuseman Well in that case I tried to eneable it with something missing, and Ikd what it was maybe you need hyper-v eneabled same as for Linux subsystem?

wuseman

Curious
You're not being terribly clear here on what worked and what didn't.

Curious

Btw they many guides also recommend unattended.xml answer file during install for basic preparation of things and I found that many recommend this one:
https://schneegans.de/windows/unattend-generator/

Does anyone have expirience with it? Is it safe?
I also checked website and it seems like it is hardcoded on a single page without any extra calls somewhere else.