Basic Security Amahl Farouk's PC Security Config 2021

[Amahl Farouk]

Hi, all - thanks for the help so far. Your configurations have been very useful in tweaking my system as well.

I am curious on the hardware virtualization part if you have any particular tips. For example, I cannot figure out how to make Kernel DMA work. The System Config says DMA is enabled but Kernel DMA not. Wondering if other users have a similar setup/laptop--might be a hardware compatibility issue?

Anyways, looking forward to any ideas and feedback.

 

[ForgottenSeer 85179]

Your setup is like mine. Looks also you copy my post style too

Kernel DMA can't be activated if Thunderbold is missing.
Virtualization Based Security can't be used on Window Pro even if it's configurable. See e.g. clarify enterprise sku · Issue #8935 · MicrosoftDocs/windows-itpro-docs (github.com)

I also have a question because your avatar:
Are you CHEF-KOCH ?

 

[Amahl Farouk]

Your setup is like mine. Looks also you copy my post style too

Kernel DMA can't be activated if Thunderbold is missing.
Virtualization Based Security can't be used on Window Pro even if it's configurable. See e.g. clarify enterprise sku · Issue #8935 · MicrosoftDocs/windows-itpro-docs (github.com)

I also have a question because your avatar:
Are you CHEF-KOCH ?

Yeah, I took a lot of inspiration from your post and tweaks; hope you don't mind.
I disabled Thunderbolt in BIOS, so that should cover that attack vector.

No, I'm not Chef-Koch. Just enjoyed Legion

 

[ForgottenSeer 85179]

Yeah, I took a lot of inspiration from your post and tweaks; hope you don't mind.

Sure! I like it if someone like my stuff

I disabled Thunderbolt in BIOS, so that should cover that attack vector.

You can activate the protection anyway if you want so if someone reset your BIOS, you still enjoy the protection
A BIOS password should be configured too.

No, I'm not Chef-Koch. Just enjoyed Legion

All right! Sorry for asking

 

[Amahl Farouk]

Sure! I like it if someone like my stuff


You can activate the protection anyway if you want so if someone reset your BIOS, you still enjoy the protection
A BIOS password should be configured too.


All right! Sorry for asking

Yeah, I added a strong UEFI admin password and also enabled the group policy to force UEFI lock + DMA protection. It works with no issues, despite DMA not being enabled.

Also, I'm sure it's common knowledge around these parts, but here's a baseline I've used as a guide for most of the manual config done on this PC.

I did check out the tools that @Andy Ful provided , but I like to keep my tweaks manual so I remember/understand what each one does before I change it.

 

[harlan4096]

Even having BackUps to cloud and/or external device, I would add a full Image System BackUp... recovering a system with for example, Macrium Reflect it's easy and fast...

And in Periodic scanning, I would add something different than own WD on demand scans...

 

[Amahl Farouk]

Even having BackUps to cloud and/or external device, I would add a full Image System BackUp... recovering a system with for example, Macrium Reflect it's easy and fast...

And in Periodic scanning, I would add something different than own WD on demand scans...

Was thinking of adding Malwarebytes as a 2nd-opinion scanner for scheduled scans but I don't know how well it plays with a hardened WD setup. I've used it back in the Windows 7 days, but have been a Linux user for the past 4 years and haven't used Windows 10 until I switched to it a few weeks ago.


EDIT: Added Malwarebytes Antivirus Free as a second opinion scanner. Got a minor complaint by WD about Memory access by the Malwarebytes process, but all seems to be running smoothly.