Advanced Security oldschool's surfing laptop configuration

[Trident]

I have a low-end turtle of a laptop that's good enough for me.

If it becomes too slow, you can always deploy ChromeOS Flex (if not too problematic)

 

[oldschool]

If it becomes too slow, you can always deploy ChromeOS Flex (if not too problematic)

Nope. Windows 11 is just fine, but thanks anyway.

 

[oldschool]

I discovered that Startpage does tracking via redirects so I'm back to Disroot SearX

I'm perfectly satisfied with my current security setup with no desire to try others.

 

[oldschool]

Added MS Store version of LibreWolf as described @ LibreWolf Browser. No hassle usage with SAC enabled and auto updates.

 

[oldschool]

Switched to Ungooogled Chromium as my daily driver and made other very minor edits to configuration.

 

[oldschool]

Uninstalled Ungoogled Chromium (no video support due to disabled location) so back to Chrome.

 

[oldschool]

Switched to µBO in Chrome. Cruising with Hard Mode for now. I love using Advanced User modes. It's like driving a car. Experience makes for safe and savvy drivers.

 

[oldschool]

Adding to the above post, here are my LibreWolf filter lists.

 

[oldschool]

Upgraded to Windows Pro via Ghacks deal $39.95 US. Good for 3 devices. It's worth it to simplify dealing with MS bloat.

 

[brambedkar59]

Upgraded to Windows Pro via Ghacks deal $39.95 US. Good for 3 devices. It's worth it to simplify dealing with MS bloatware.

I upgraded to pro last year just so that I can use Gpedit, worth the cheap license key. Tried cmd hack (for using GPedit on home version) earlier but it stopped working for me for some reason.

 

[ForgottenSeer 103564]

Upgraded to Windows Pro via Ghacks deal $39.95 US. Good for 3 devices. It's worth it to simplify dealing with MS bloat.

That's quite the deal really. Now you crack open gpedit and go crazy on some policy restriction rules and lock your system down so tight it wont budge

 

[oldschool]

Configured basic SRP to Disallowed - all software and dll's. SAC covers some of the details like block rules for LOLBins.

MS apparently has fixed issues with blocked Windows Security Health. No problems so far.

 

[oldschool]

Replaced Librewolf with Firefox after fixing streaming video issue by adjusting Exploit Protection. The new settings for FF are:

Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON

 

[oldschool]

Removed SRP as policies don't appear to work properly in 22H2. Nothing was blocked at all. @Andy Ful

Cleaned up some config details. BTW, I really like Mem Reduct. Way better than CleanMem. Works like a charm with my 8GB RAM.

 

[ForgottenSeer 103564]

Removed SRP as policies don't appear to work properly in 22H2. Nothing was blocked at all. @Andy Ful

Cleaned up some config details. BTW, I really like Mem Reduct. Way better than CleanMem. Works like a charm with my 8GB RAM.

You are correct it appears Windows 11 22H2 put an end to Software Restriction Policies. Still supported in Windows 10 though. Looks as if they redirect windows 11 users to App Locker instead.

 

[oldschool]

Looks as if they redirect windows 11 users to App Locker instead.

They're pushing Windows Application Control.

Starting in Windows 11 version 22H2, Smart App Control provides application control for consumers. Smart App Control is based on WDAC ...

Application Control for Windows - Windows Security
Smart App Control is the simple and easy way to go, so I'll stick with that.

 

[ForgottenSeer 97327]

They're pushing Windows Application Control.

Application Control for Windows - Windows Security
Smart App Control is the simple and easy way to go, so I'll stick with that.

Especially when you use a different than Microsoft anti-virus it is a bonus (double whitelist-blacklist protection)

 

[oldschool]

Finally fixed the printing issue with Edge not loading Print Preview. Solution was minor adjustment to Exploit Protection settings.

 

[Moonhorse]

Is SAC worked without problems on your laptop?

 

[oldschool]

Is SAC worked without problems on your laptop?

Yes except for one unsigned app I need to execute via RunBySmartscreen, otherwise it's blocked periodically without it. Using RBS this way may be useful to SAC users as SS is integrated with ISG in SAC. You can read here New Update - Smart App Control - Windows 11 22H2 feature promises significant protection from malware But please know that I use very few 3rd party apps. Almost none. This is mainly a surfing laptop. Most folks can't operate like I do.

3rd party apps:

Mindfulness at the computer (not signed)
Mem Reduct (signed from Henry++ GitHub)
Nanzip (MS Store)
iTunes (MS Store)
Aomei Backupper
Epson printer softs

Edit: One thing to remember is that when SAC blocks part of an app it may well still be fully functional for all practical purposes. e.g. some Aomei dll's or even some Windows processes, in much the same way as Controlled Folder Access blocks.