Hardening Windows

Version 0.1: These mitigations are all based on Windows 10. Supposedly, Windows 11 has better security. Some of these mitigations may still be applicable and useful. When we have an 11 key we will install, test it, and add mitigations.

Accounts and authentication

• Introduction
• More secure login
• Require a password when resuming from a stand-by mode
• Make that more secure passwords
• Use a password manager
• Use multifactor authentication (MFA)
• Use a standard user account
• Protect SSH access with MFA

Services and applications

• Introduction
• Start, stop, restart, enable, and disable services
• Restricting access to applications
• Block internet access to specific apps
• Maximise user account control (UAC)
• Unwanted application suggestions
• Secure browsers that protect your privacy
• Use a secure messaging service
• Use secure email services
• Use SSH tunnels
• Use a VPN service
• Make a VPN killswitch using routes
• Use alternative DNS servers
• Use a Tor proxy
• Change MAC address
• Renew IP lease
• Edit hosts file

Data

• Introduction
• Create a restore point
• Enable full disk encryption using BitLocker
• File encryption
• Enable controlled folder access (CFA)

Privacy

• Introduction
• Disable location tracking
• Disable Ad tracking by Microsoft Ad partners
• Turning devices on and off
• Remove metadata from files
• Edit exif metadata in images
• Remove metadata with hex editors
• Clean machine with BleachBit

Malware

• Introduction
• Malware detection and removal
• Catch and remove malicious registry entries
• Analysing trojans

Operations security

• Introduction
• Use email securely
• Detecting fake emails and phishing
• Browse more safely
• Check integrity of downloads
• ‘;–have i been pwned?

Guards! Guards!

• Introduction
• Alphabet soup
• Windows intrusion detection systems