Hardening Windows for privacy and security

Graphene18

[deleted] Hah, nice joke.

[deleted]

Relaks

FYI, you will need at least the Pro version of Windows 10/11 to be able to turn off telemetry and data collection through Group Policy Editor. As far as I know only Windows Enterprise allows for turning off telemetry completely. (Correct me if I'm wrong on that part).

Graphene18

Relaks FYI, you will need at least the Pro version of Windows 10/11 to be able to turn off telemetry and data collection through Group Policy Editor. As far as I know only Windows Enterprise allows for turning off telemetry completely. (Correct me if I'm wrong on that part).

[deleted] Use windows enterprise or education, then use GPO.

I already use Windows 11 Enterprise.

[deleted] https://github.com/beerisgood/Windows11_Privacy
https://github.com/beerisgood/Windows11_Hardening

Thanks, will take a look.

[deleted]

Use windows enterprise or education, then use GPO.

https://github.com/beerisgood/Windows11_Privacy
https://github.com/beerisgood/Windows11_Hardening

[deleted]

Then just turn off everything you don't need in privacy settings
For the rest, use GPO to modify telemetry and other settings you need.
Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds : and set it to level 0

Don't use weird scripts to make system modifications.

Relaks

[deleted] Don't use weird scripts to make system modifications.

Totally agree. Also, I advise to stay away from third-party applications that promise to turn off telemetry etc. Who knows what they actually do with your system (and investigating this is probably not worth the time).

[deleted]

I can't remember if they're in the guide I posted: But take a look at how to install windows sandbox : https://www.xda-developers.com/set-up-windows-sandbox-windows-11/?newsletter_popup=1

Edge also has a sandbox mode, which can be set by GPO. A second browser, well isolated from the rest of the applications, is then possible : https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard

Note that edge benefits from some of the same telemetry settings you'll be setting on windows.
It has a secure mode that can be activated in the settings to disable JIT, like vanadium.
Disable other optional settings that you don't need.

[deleted]

Relaks
I know that some people block DNS on certain queries.
I don't know if it's really relevant,

newbie24689

Load windows as a temporary VM into Qubes-os; copy in any data to process; do your Windows thing; copy any updated data to an isolated database; flush the VM.
If Windows is hacked, the damage will be confined to the VM and not the computer firmware.
When updating Windows, load it in as a temporary VM; update (do nothing else); save it for future uses.
https://www.qubes-os.org/

titaniumtown

[deleted] lmfao

titaniumtown

[deleted] it's funny because it's an incorrect statement

Relaks

Yes, very funny. The reality is that some of us are stuck with Windows for various reasons; even if I personally would prefer to use less privacy-invasive OSes. Minimizing data collection is what we can do in these cases.

[deleted]

titaniumtown ok it's funny... windows is secure and privacy friendly. https://madaidans-insecurities.github.io/security-privacy-advice.html#operating-system

[deleted]

titaniumtown and if windows isn't enough for you, you can install whonix.

titaniumtown

[deleted]

ok it's funny... windows is secure and privacy friendly. https://madaidans-insecurities.github.io/security-privacy-advice.html#operating-system

lol no

UpStream

[deleted] While Windows is somewhat secure it doesn't necessarily mean that it's private as well. Privacy and security aren't the same thing. Even the source you mentioned only states the following about privacy:

https://madaidans-insecurities.github.io/security-privacy-advice.html#:~:text=Some%20of%20these%20operating%20systems%20do%20have%20some%20privacy%20invasive%20telemetry%2C%20but%20it%20can%20usually%20be%20disabled%20in%20the%20settings%20and%20verified%20with%20a%20network%20analyser%20tool%20like%20Wireshark%20if%20you%20wish%20to%20be%20certain.

Also no specifics have been given there and the emphasis lies on usually.

titaniumtown

[deleted]

and if windows isn't enough for you, you can install whonix.

I haven't used windows in 10 years. I don't need advice on switching operating systems. Also, who uses whonix as a daily driver?

[deleted]

Your privacy depends solely on what you do with your tools. Nothing and nobody can protect your privacy, even on GOS.

[deleted]

There are thousands of Reddit or other posts on this subject.