Basic Security ParaXY's Windows 10 desktop Config

[ParaXY]

Hi All

I've been lucky enough to obtain a copy of Windows 10 Enterprise LTSB which I plan on using to rebuild my desktop. Currently I use Windows 10 Education but I like the idea that LTSB doesn't have the bloat that the CBB branch has. LTSB doesn't have the Edge browser, Cortana and those silly "modern" apps. This suits me perfectly as I don't need/want/use any of those items. I'm aware that with LTSB you don't get any new features and I'm ok with that. In the upcoming Creators Updates about the only thing I was vaguely interested in was the new registry editor!

So in my quest to build a secure and practical Windows 10 desktop WITHOUT any third party apps, I will be taking the following steps and using the following products to achieve my goal(s):

1) Install Windows 10 Enterprise LTSB and setting the telemtry value to "security" to minimise this type of traffic *See below for more

2) Disable or turn off all privacy settings

3) Turn UAC up all the way

4) I'll have two user accounts on the machine: admin and non-admin. I'll be using the non-admin account on a day to day basis and where needed I'll use the admin account for changes etc

5) Delete ALL the default Windows firewall rules and block ALL incoming and outgoing traffic except for the exceptions I set. For incoming I will only allow ICMPv4/6 for troubleshooting and for outgoing I have some rules to allow DHCP/DNS/HTTP(S) and a few others for internal use like RDP to servers. I also allow NTP and let svchost.exe have port 80/443 acccess for Windows Updates to work. I block IE11 from outgoing traffic as I use Firefox/Chrome/Chromium

6) Enable AppLocker. On the current test build I only have Windows and Office installed so I am using Publisher rules to only allow MS signed executables to run for non-admin users. The admin account can run anything/everything. As I install more software I will need to add more Publisher rules. Non-admin users can't run Windows Installers or run scripts. I'm currently allowing everyone to run Packaged apps but need to change that (or lock it down). I also use dll protection. I have Flash blocked. For executables that aren't digitally signed I'd have to use path based rules as hash rules sound like a pain to maintain

7) I'll be using Windows Defender for AV (and have the VirusTotal program installed for uploading suspicious files for scanning)

8) I have a lifetime license for Sandboxie but am unsure if I need to use this now that I will have AppLocker

9) All local drives are Bitlocker encrypted and use a Smart Card to unlock them (I also login to Windows using this same Smart Card)

* As of yesterday I started using Pi Hole and this seems to block all (or most I guess) of the Telemetry traffic

So I was hoping someone could have a look at my setup and comment or make suggestions as to what I could do to improve things or tell me if I have done something wrong. My goal is to NOT use any third party products. Not because I can't buy products to secure my machine but because I am a minimalist and like things to be snappy and perform well. I also don't like subscription based software.

Currently I have everything setup in a test VM (and have created an unattended customised ISO) that I am using to test things before doing the rebuild of my desktop but what I would like to do at the end of configuring everything is to run some test malware/ransomeware on the test VM to see how it copes. Just typing that last sentence sent shivers down my spine but without doing this I have *no* idea if this setup is any good in the real world. I have never tested (or delibrately) run malware/ransomware on any machine so this would be a first for me ;-)

Anyways, thanks for reading and look forward to some comments/suggestions! If you need more specifc info please ask.

 

[Deleted member 178]

Well thought setup. You are doing exactly what i wish to do if i had the Enterprise version. Indeed no need 3rd party apps if you know what you are doing and have safe habits. Enterorise version is very powerful.

8) I have a lifetime license for Sandboxie but am unsure if I need to use this now that I will have AppLocker

Useful, Sbie allows you to isolate internet oriented folders and will definitely improve your browsing safety.

my settings Sandboxie's settings (when i used it) : Sandboxie Configuration Discussion Thread

 

[ParaXY]

Thanks for your input!

I'm on the fence at the moment regarding Sandboxie. I'm leaning towards NOT using it as:

1) I have restrictive AppLocker rules and will be browsing as a non-admin user

2) If I really want to go wild with high risk browsing then I normally create a linked clone throw away VM in VMware Workstation Pro 12.5 (Funny story: One time with a throw away VM I tried my hardest to get infected as a test but failed!)

Is there any recommeded approach for testing my setup in a VM with malware/ransomware?

 

[Exterminator]

Nice secure Windows 10 Enterprise Config! Thanks for sharing it with us

 

[Winter Soldier]

Is there any recommeded approach for testing my setup in a VM with malware/ransomware?

First fundamental rule is to deal with malware into a controlled environment.
For no reason you should ever try to handle malware outside a Virtual Machine
Your VM needs to be clean without any trace of personal Information.
Never check your mail, store personal stuff in the analysis VM.
It should never to have the need of a shared folder between the VM and Host. Always drop your tools into the VM before starting the infection process test.
Before starting analysis, close any shared folder, to avoid malware spread.

 

[ParaXY]

Nice secure Windows 10 Enterprise Config! Thanks for sharing it with us

Thanks for the feedback! Hopefully I haven't missed anything important...

First fundamental rule is to deal with malware into a controlled environment.
For no reason you should ever try to handle malware outside a Virtual Machine
Your VM needs to be clean without any trace of personal Information.
Never check your mail, store personal stuff in the analysis VM.
It should never to have the need of a shared folder between the VM and Host. Always drop your tools into the VM before starting the infection process test.
Before starting analysis, close any shared folder, to avoid malware spread.

That sounds very sensible to me. When testing my VM, it's a clean install (customised) so there is zero data/passwords etc in it.

Good point about the shared folders between VM and host!

I don't have any test malware/ransomware but that's what I am aiming for to fully test my customised VM.

This Windows install has been great, I've documented all my changes as I've gone along so everytime I read something new or helpful I test it in the VM and then add it to the change document.

At one stage I used something called "SuSun" which was REALLY useful when I ran a non-admin account with UAC turned all the way up. Any thoughts or opinions on this tool? I am keen on using it in my new build as having to enter a 30+ character password (or use a second smart card) for the admin account every time UAC prompts me is going to be painful...

 

[DracusNarcrym]

Excellent vanilla Windows config. Impressive too. Thanks for sharing.

 

[ParaXY]

Excellent vanilla Windows config. Impressive too. Thanks for sharing.

Should I rather call it: Vanilla 10? heh

 

[ParaXY]

So has anyone used SuSun? I'm curious to hear the good, the bad and the ugly regarding this!

 

[Winter Soldier]

So has anyone used SuSun? I'm curious to hear the good, the bad and the ugly regarding this!

Believe me or not, I haven't found anything about "SuSun" except for the non-relevant Google results

 

[ParaXY]

Believe me or not, I haven't found anything about "SuSun" except for the non-relevant Google results

Thats a shame. When I used it on my previous build it was quite useful but, yes, there is little info about this utility.

I'm currently a Firefox user but am looking into possibly using Chrome on my new secure build. Good idea? Bad? I've also had a look at Chromium which looks like it has less bloat than Chrome.

Is there anyone else here that used two factor to login to Windows? I'd be interested to hear what software/hardware you use for this. And if you use 2FA with Bitlocker too!

 

[ParaXY]

The other thing I have been thinking about is, which of the following Windows features can I turn off for my secure desktop image:

The ones that jump to mind straightaway are IE11, Windows Media Player and both XPS services.

Any recommendations here?

 

[DracusNarcrym]

I'm currently a Firefox user but am looking into possibly using Chrome on my new secure build. Good idea? Bad? I've also had a look at Chromium which looks like it has less bloat than Chrome.

I have always had Google Chrome (just the default Chrome) as a backup browser, and have recently started using more extensively because of the additional speed and stability it provides in long up-time scenarios (i.e. having it open day and night for days or even weeks straight) - it hasn't let me down in this regard.

My common concern is how it handles cache and other local files it creates - there is absolutely no way to replicate Firefox's "Clear all cache on exit" function in any Chromium-based browser, without the use of some sort of external application or runtime. (I have scoured the web for a Chrome extension that does it, but this function seems impossible to be implemented - as if it's hardcoded not to be possible)
This has forced me to use CCleaner Pro to actively monitor for Chrome, so that CCleaner cleans up all local Chrome files whenever the latter closes.

Anyway, I recommend you keep and update both browsers, Firefox and Chrome, and use each other interchangeably, depending on your needs and each scenario.
(generally Firefox is "good faith" software, while Chrome is generally more stable/secure, and a bit heavier, although this has also been mitigated in latest Chrome releases)

 

[DracusNarcrym]

The other thing I have been thinking about is, which of the following Windows features can I turn off for my secure desktop image:

View attachment 143112

The ones that jump to mind straightaway are IE11, Windows Media Player and both XPS services.

Any recommendations here?

Consider also turning off "Windows Fax and Scan" and "Microsoft Print to PDF".

"Telnet Client" should be disabled by default in Windows 10, as far as I know, so do turn that off as well.

You can look up what each of these features does on the web to help you in making the final decision.

 

[Rengar]

Congrats! You are protected

 

[ParaXY]

I have always had Google Chrome (just the default Chrome) as a backup browser, and have recently started using more extensively because of the additional speed and stability it provides in long up-time scenarios (i.e. having it open day and night for days or even weeks straight) - it hasn't let me down in this regard.

My common concern is how it handles cache and other local files it creates - there is absolutely no way to replicate Firefox's "Clear all cache on exit" function in any Chromium-based browser, without the use of some sort of external application or runtime. (I have scoured the web for a Chrome extension that does it, but this function seems impossible to be implemented - as if it's hardcoded not to be possible)
This has forced me to use CCleaner Pro to actively monitor for Chrome, so that CCleaner cleans up all local Chrome files whenever the latter closes.

Anyway, I recommend you keep and update both browsers, Firefox and Chrome, and use each other interchangeably, depending on your needs and each scenario.
(generally Firefox is "good faith" software, while Chrome is generally more stable/secure, and a bit heavier, although this has also been mitigated in latest Chrome releases)

Thanks for your input!

I was thinking of uninstalling IE11 from programs and features since I never use it. Edge doesn't come with LTSB so no worries there.

I think I'll follow your recommendation. Funnily enough I use Firefox as my main browser currently and then use Chrome as a "Plan B" browser. Both are updated regularly and Firefox has most of the extensions I use daily (like to block ads) I really don't like the way Chrome hides SSL certificate info now...grr!

 

[ParaXY]

Consider also turning off "Windows Fax and Scan" and "Microsoft Print to PDF".

"Telnet Client" should be disabled by default in Windows 10, as far as I know, so do turn that off as well.

You can look up what each of these features does on the web to help you in making the final decision.

Should have mentioned that I enabled the telnet client as I do use it from time to time.

So far I've decided to turn off the following features:

IE11
Media Features/Windows Media Player
Microsoft Print to PDF
Windows Fax and Scan
XPS Service
XPS Viewer

Still thinking about disabling SMB 1.0...

 

[ParaXY]

Congrats! You are protected

Well I'm not sure yet until I run some test malware/ransomware on my test VM to see how it performs!

 

[Deleted member 178]

The other thing I have been thinking about is, which of the following Windows features can I turn off for my secure desktop image:

View attachment 143112

The ones that jump to mind straightaway are IE11, Windows Media Player and both XPS services.

Any recommendations here?

Remove SMB 1.0, obsolete protocol from XP and exploitable; we are now on v3.0+

 

[Ink]

Remove SMB 1.0, obsolete protocol from XP and exploitable; we are now on v3.0+

Wonder why Microsoft keeps it present? Must be a threat from XP users "You can take away our OS, but not our Protocol. Long live XP!!"