Advanced Plus Security n8chavez's PC Security Config

[n8chavez]

Here is my system configuration. I try to automate as much as possible, from imaging my SSD to rcloning data backups to an encrypted GDrive. From a security standpoint, I try to keep things proactive, not reactive. I do not use malware scanners, or any third party anti-malware software.

Let me know what you think!

 

[Kongo]

Nice config. Consider setting UAC to "Max" to prevent UAC bypasses. Also consider picking a second additional scanner next to HitmanPro as it can't detect scripting malware for example.

 

[simbatippe1234]

Hi, I am truly impressed, I wish I had the know-how to set up my Laptop similar to yours @n8chavez, real technical & very great Configuration!
Respect!

 

[n8chavez]

Nice config. Consider setting UAC to "Max" to prevent UAC bypasses. Also consider picking a second additional scanner next to HitmanPro as it can't detect scripting malware for example.

Thanks! But that's where VoodooShield comes into play; it detects anything running on my system and prompts me. There's no need for both UAC @ max and VS, since theyr do the same thing.

 

[n8chavez]

Hi, I am truly impressed, I wish I had the know-how to set up my Laptop similar to yours @n8chavez, real technical & very great Configuration!
Respect!

Thanks @ simbatippe1234! I've run variations of this config for over a decade, with no problems. If there's anything I can ever help you configure/setup just ask.

 

[Kongo]

Thanks! But that's where VoodooShield comes into play; it detects anything running on my system and prompts me. There's no need for both UAC @ max and VS, since theyr do the same thing.

Oh, my bad. I think last time I tried VoodooShield it even told me to disable UAC if I remember correctly.

 

[n8chavez]

Oh, my bad. I think last time I tried VoodooShield it even told me to disable UAC if I remember correctly.

It's a fantasic program! I highly recommend it.

 

[Kongo]

It's a fantasic program! I highly recommend it.

I know that it is, but I am not a big fan of a layered approach. At least of using multiple solutions running in real-time.

 

[Andy Ful]

There's no need for both UAC @ max and VS, since theyr do the same thing.

They do not, but the attacks that could use this difference are rare. So, if one does not like UAC on MAX, then using VS (or similar protection) is a good idea.

 

[n8chavez]

They do not, but the attacks that could use this difference are rare. So, if one does not like UAC on MAX, then using VS (or similar protection) is a good idea.

Either VoodooShield or something like OSArmor. Both are very good.

 

[Andy Ful]

Either VoodooShield or something like OSArmor. Both are very good.

Any smart default-deny setup. There are many good choices: SRP, anti-EXE, Comodo auto-sandbox, etc.
Simply, if one blocks/contains something by default then it cannot elevate or it is contained in the sandbox.

Edit.
OSArmor might have to be highly tweaked if one would like to skip UAC on MAX.

 

[n8chavez]

Any smart default-deny setup. There are many good choices: SRP, anti-EXE, Comodo auto-sandbox, etc.
Simply, if one blocks/contains something by default then it cannot elevate or it is contained in the sandbox.

Edit.
OSArmor might have to be highly tweaked if one would like to skip UAC on MAX.

Yuuup. But, after all, we are a community of tweakers!

 

[Andy Ful]

Any of the mentioned solutions (including VS) will be stronger with UAC MAX in the postinfection stage. But, most users who like such solutions will not be probably infected, at all.

 

[n8chavez]

Any of the mentioned solutions (including VS) will be stronger with UAC MAX in the postinfection stage. But, most users who like such solutions will not be probably infected, at all.

Any setup has to balance security with usability. If not why don't we all disconnect and turn off our systems? They would be completely secure then!

 

[n8chavez]

n8chavez's PC Security Config · Setup v3
Updated Oct 3, 2026

What changed

• Real-time protection: Sandboxie Plus (via RAM drive)
  Cyberlock with SiriusLLM
  Windows Security ( hardened )
  AdGuard for Windows → ShadowFreeze
  Cyberlock
  Windows Security ( hardened )
  AdGuard for Windows
• Password and passkey manager: Bitwarden Premium → Enpass Premium with local database
• Maintenance tools: Not much needed, other than winget. Everything that has internet connectivity is configured via sandboxie to clean out cache/changes at close. → Not much needed, other than winget. ShadowFreeze in frozen mode keeps my system clean.
• OS version and support details: Not specified → 26h2
• Device sign-in security: Older selection — review required → Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID)
• Two-factor authentication: Not specified → Proton Authenticator
• Usage and exposure: Older selection — review required → Visiting familiar websites, Visiting unknown or untrusted websites, Working from home, Making audio/video calls, Opening email attachments, Downloading software and files from reputable sites, Gaming, Gaming with third-party mods, Streaming audio/video content from trusted sites or paid subscriptions, Coding and development
• Feedback preference: Older selection — review required → Showcase only - no advice requested

Spoiler: Full setup snapshot

My current setup

• Operating system: Windows 11
• Real-time protection: ShadowFreeze
  Cyberlock
  Windows Security ( hardened )
  AdGuard for Windows
• File and photo backups: Changed files are backup up daily via rclone to an encrypted and 2fa Mega.nz; including music, video, documents, installer files, photos, ISOs, ebooks and disk images
• Device firewall: Microsoft Defender Firewall
• Browsers and extensions: Vivaldi
  addons: TamperMonkey, Dark Read, Privacy Badger
• Main use of this computer: For home and private use
• OS version and support details: 26h2
• On-device encryption: VeraCrypt
• Device sign-in security: Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID)
• Security updates: Allow security updates and latest features
• Update channels: Allow stable updates only
• User Account Control (UAC): Notify me only when programs try to make changes to my computer
• Smart App Control: Off
• Network firewall: Enabled
• Custom security settings: Binisoft's Windows Firewall Control GUI
• Periodic malware scanners: HitmanPro
• Malware sample testing: I do not participate in malware testing
• Environment for malware testing: N/A
• Secure DNS: ControlD
• Desktop VPN: Mullvad
• Password and passkey manager: Enpass Premium with local database
• Two-factor authentication: Proton Authenticator
• Maintenance tools: Not much needed, other than winget. ShadowFreeze in frozen mode keeps my system clean.
• Subscriptions: None
• System recovery: System images (partitions required for my system to boot) are created daily and automatically via scheduled scripts using Terabyte's Image for Windows . Full images are created weekly, and differential images are created daily.
• Usage and exposure: Visiting familiar websites, Visiting unknown or untrusted websites, Working from home, Making audio/video calls, Opening email attachments, Downloading software and files from reputable sites, Gaming, Gaming with third-party mods, Streaming audio/video content from trusted sites or paid subscriptions, Coding and development
• Computer specs: Hardware
  
  Motherboard: Asus Prime Z790-P
  GPU: Nvidia RTX 4070 Super
  Memory: 64 GBytes ＠ DDR 5 Kingston Fury 6000MHz
  Storage: Disk 1 20TB Seagate Enterprise ＠ 7200RPM,
  Disk 2 Samsung 990 EVO Pro 1TB ＠ 5425RPM
  Disk 3 Samsung 990 EVO Pro 2TB w/Heatsink
  
  
  
  
  CPU Brand Name:
  Intel(R) Core(TM) i7-14700KF CPU ＠ 5.60GHz
  
  
  
  
  CPU Vendor:
  GenuineIntel
  
  
  
  
  CPU Stepping:
  B0
  
  
  
  
  CPU Code Name:
  Raptor Lake
  
  
  
  
  CPU Technology:
  14 nm
  
  
  
  
  CPU S-Spec:
• Notable changes: Replaced Waterfox with Vivaldi
  
  Eliminated jshelter
  Eliminated uBo
  Eliminated Bitwarden
  Added AdGuard for Windows
  
  Added Cyberlock plus SiriusLLM
• Feedback preference: Showcase only - no advice requested

Shared as my personal configuration.

 

[n8chavez]

Only a couple changes made, most notable eliminating Sandboxie Plus and replacing it with ShadowFreeze. That's the spiritual successor to shadow Defender, and made by the same author as Sandboxie.