Basic Security root's security configuration 2020

[root]

.

 

[harlan4096]

You may set UAC to Always Notify.

You can enforce Windows Defender protection using tools such as Simple_Windows_Hardening or Hard_Configurator or just Configure_Defender. Alternativelly You may pair Windows Defender with VoodooShield tool.

In Photos and Documents Backup , you may consider also cloud services.

In Backup and Restore, You may add a full Image System BackUp solution: Macrium Reflect Free or AOEMI Backupper, both are free and reliable.

In Periodic Scanners, You may add MalWareBytes Free, EmsiSoft Emergengy Kit and HitManPro Free.

A PassWord Manager would be welcome also.

Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing

 

[Gandalf_The_Grey]

No log-in security? Please set at least a password on your account.

Like @harlan4096 said set UAC to always notify to prevent UAC bypasses.
An example: Bypassing Windows 10 UAC with mock folders and DLL hijacking

Microsoft Defender is great and built in.
You can enhance its protection by using Configure Defender made by our own @Andy Ful :

GitHub - AndyFul/ConfigureDefender: Utility for configuring Windows 10 built-in Defender antivirus settings.

Utility for configuring Windows 10 built-in Defender antivirus settings. - AndyFul/ConfigureDefender

github.com

ConfigureDefender utility for Windows 10

ConfigureDefender utility for Windows 10/11. New version 4.0.0.0 is available on the developer website (updated in January 2024): https://github.com/AndyFul/ConfigureDefender Softpedia: https://www.softpedia.com/get/PORTABLE-SOFTWARE/System/System-Enhancements/ConfigureDefender.shtml...

malwaretips.com

I would recommend the high protection level.

I would suggest to first have look at Configure Defender and if you're comfortable with that you can optionally do some more windows hardening by using one of these tools also from @Andy Ful : Simple Window Hardening or hard Configurator:

Hard_Configurator/Simple Windows Hardening at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

New Update - Simple Windows Hardening

Post updated in July 2023. SWH ver. 2.1.1.1 - July 2023 (added support for Windows 11 ver. 22H2) https://github.com/AndyFul/Hard_Configurator/raw/master/Simple%20Windows%20Hardening/SimpleWindowsHardening_2111.zip SWH ver. 2.0.0.1 - August 2022 (no support for Windows 11 ver. 22H2)...

malwaretips.com

GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

Hard_Configurator - Windows Hardening Configurator

Post updated in July 2023. WARNING! The fake domain hard-configurator.com is currently (May 2023) used by some malicious actors. Please do not use it. Someone tries to fool people who want to get information about Hard_Configurator. Support for Windows 11 22H2 was added in the new version...

malwaretips.com

When you are using all windows built-in tools for protection it is maybe an idea to switch from Mozilla Firefox to the new Microsoft Edge:

Safety and privacy in Microsoft Edge

October is almost over! The leaves are changing, pumpkin spices are everywhere, and frights and haunts are becoming commonplace. In the U.S., it’s also National Cyber Security Awareness month. To celebrate it all, we’ll share some of the great se

blogs.windows.com

 

[Cortex]

If you are using external hard drives why do you need to use slow & limited cloud backup too, I don't use any cloud services (hard drives somewhere else) & it would take aeons to back up my data to cloud ? I do use four external drives backed up on separate days/weeks?

 

[root]

You may set UAC to Always Notify.

You can enforce Windows Defender protection using tools such as Simple_Windows_Hardening or Hard_Configurator or just Configure_Defender. Alternativelly You may pair Windows Defender with VoodooShield tool.

In Photos and Documents Backup , you may consider also cloud services.

In Backup and Restore, You may add a full Image System BackUp solution: Macrium Reflect Free or AOEMI Backupper, both are free and reliable.

In Periodic Scanners, You may add MalWareBytes Free, EmsiSoft Emergengy Kit and HitManPro Free.

A PassWord Manager would be welcome also.

Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing

Always Notify is too intrusive for my uses.
Microsoft Defender is plenty, no need to bloat.
I don't trust the cloud (and neither should you).
I'd rather clean format than restore from image.
I'd also rather clean format than scan for malware.

No log-in security? Please set at least a password on your account.

Like @harlan4096 said set UAC to always notify to prevent UAC bypasses.
An example: Bypassing Windows 10 UAC with mock folders and DLL hijacking

Microsoft Defender is great and built in.
You can enhance its protection by using Configure Defender made by our own @Andy Ful :

GitHub - AndyFul/ConfigureDefender: Utility for configuring Windows 10 built-in Defender antivirus settings.

Utility for configuring Windows 10 built-in Defender antivirus settings. - AndyFul/ConfigureDefender

github.com

ConfigureDefender utility for Windows 10

ConfigureDefender utility for Windows 10/11. New version 4.0.0.0 is available on the developer website (updated in January 2024): https://github.com/AndyFul/ConfigureDefender Softpedia: https://www.softpedia.com/get/PORTABLE-SOFTWARE/System/System-Enhancements/ConfigureDefender.shtml...

malwaretips.com

I would recommend the high protection level.

I would suggest to first have look at Configure Defender and if you're comfortable with that you can optionally do some more windows hardening by using one of these tools also from @Andy Ful : Simple Window Hardening or hard Configurator:

Hard_Configurator/Simple Windows Hardening at master · AndyFul/Hard_Configurator

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

New Update - Simple Windows Hardening

Post updated in July 2023. SWH ver. 2.1.1.1 - July 2023 (added support for Windows 11 ver. 22H2) https://github.com/AndyFul/Hard_Configurator/raw/master/Simple%20Windows%20Hardening/SimpleWindowsHardening_2111.zip SWH ver. 2.0.0.1 - August 2022 (no support for Windows 11 ver. 22H2)...

malwaretips.com

GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

Hard_Configurator - Windows Hardening Configurator

Post updated in July 2023. WARNING! The fake domain hard-configurator.com is currently (May 2023) used by some malicious actors. Please do not use it. Someone tries to fool people who want to get information about Hard_Configurator. Support for Windows 11 22H2 was added in the new version...

malwaretips.com

When you are using all windows built-in tools for protection it is maybe an idea to switch from Mozilla Firefox to the new Microsoft Edge:

Safety and privacy in Microsoft Edge

October is almost over! The leaves are changing, pumpkin spices are everywhere, and frights and haunts are becoming commonplace. In the U.S., it’s also National Cyber Security Awareness month. To celebrate it all, we’ll share some of the great se

blogs.windows.com

Same as above.
This is a home desktop, so if someone's going to break into my system, they're going to have to break into my home first.

If you are using external hard drives why do you need to use slow & limited cloud backup too, I don't use any cloud services (hard drives somewhere else) & it would take aeons to back up my data to cloud ? I do use four external drives backed up on separate days/weeks?

This guy gets it. No need to over-complicate your daily routine.

 

[Ink]

A "Reformat" isn't a backup nor rollback solution.

Firefox offer their own VPN service for a price. Alternatively, Opera browser has its own proxy VPN.

Or use your own VPN (don't trust the cloud), right?

 

[root]

A "Reformat" isn't a backup nor rollback solution.

Firefox offer their own VPN service for a price. Alternatively, Opera browser has its own proxy VPN.

Or use your own VPN (don't trust the cloud), right?

Yessir, I have Windscribe VPN written down in the configuration. Got the lifetime license years ago through a link on this forum, actually.

 

[Andy Ful]

It is good to make a full disk image once which includes the EFI partition (for computers with UEFI). When one makes a clean format, the EFI partition is not affected. Of course, one can format the EFI partition (not recommended) and restore it (some skills needed). The disk format does not usually affect also the factory partitions and MBR sectors.
So when the EFI/MBR (or factory partitions) are corrupted or attacked by malware, then it is much easier to restore from the full disk image. Furthermore, one can save much time to not install/configure all needed applications.

 

[root]

It is good to make a full disk image once which includes the EFI partition (for computers with UEFI). When one makes a clean format, the EFI partition is not affected. Of course, one can format the EFI partition (not recommended) and restore it (some skills needed). The disk format does not usually affect also the factory partitions and MBR sectors.
So when the EFI/MBR (or factory partitions) are corrupted or attacked by malware, then it is much easier to restore from the full disk image. Furthermore, one can save much time to not install/configure all needed applications.

When reinstalling Windows, you can just delete the EFI and Recovery partitions. They are recreated from scratch when you select the disk and format it during the Windows installation. There is no skill required, 3 clicks to just delete and format. There are no adverse effects since this is a custom machine and not manufactured, so the EFI and Recovery partitions are not proprietary. I used to create images for the sake of saving time on reinstalling drivers and software, but it's something that takes at most 20 minutes and I'm ensuring that I have the most up-to-date drivers/software in the process.

 

[Andy Ful]

When reinstalling Windows, you can just delete the EFI and Recovery partitions. They are recreated from scratch when you select the disk and format it during the Windows installation. There is no skill required, 3 clicks to just delete and format. There are no adverse effects since this is a custom machine and not manufactured, so the EFI and Recovery partitions are not proprietary. I used to create images for the sake of saving time on reinstalling drivers and software, but it's something that takes at most 20 minutes and I'm ensuring that I have the most up-to-date drivers/software in the process.

Thanks for the clarification. It was needed to properly understand your posts. I agree that in your case there is no problem. My comment was general and not directed concretely to you but rather to the readers of these thread.

You wrote:
"I'd rather clean format than restore from image.
I'd also rather clean format than scan for malware."
Without any comment, this could be understood by readers as a generally good practice, but it is not on many machines. Furthermore, the term "clean format" could be misunderstood by readers as the format without deleting EFI, Recovery, and other hidden partitions (if necessary).
There can be also a problem with deleted partitions, especially on laptops. They usually have a Recovery partition (factory reset) and diagnostic tools. While contacting with vendor's technical support, the customers are usually asked about the results of tests made by these tools. The Recovery partition can be also useful, when there are problems with a clean Windows installation.
From your last post, I can see that you understand these potential issues, but we should not assume this for all readers.

Edit.
The fresh Windows installation will make the default EFI partition if necessary, but its size and content can be different as compared to the original EFI partition made by the laptop vendor. So, the partition can be easily created, but not always fully restored. This can be sometimes important, especially when firmware/software is installed into the EFI partition instead of the data drive.

 

[LDogg]

Off the bat, login security is certainly needed, I wouldn't even trust my own family tbh xD (for context: they mess about).
Please use Configure Defender from @Andy Ful.
Add more backups, always better to have more than 1.

~LDogg

 

[root]

Off the bat, login security is certainly needed, I wouldn't even trust my own family tbh xD (for context: they mess about).
Please use Configure Defender from @Andy Ful.
Add more backups, always better to have more than 1.

"External HDDs" is plural, so there is in fact more than one. I've expanded on why the former two suggestions aren't needed.

The rest of this post is 100% opinion and is not meant to be seen as disrespectful. This place really hasn't changed over the past few years. Same copy-and-paste responses peddling niche homemade software and all. I'd happily start using extra bloat on my machine if it could be explained to me why I would need the extra bloat for my specific uses. "Please use X" isn't convincing enough for me, I'm just being told to blindly follow. It started with Appguard, then moved on to VoodooShield (look how that ended), and now we're onto the next. With that said, we have great developers on the forum, such as Andy, so do his software justice by explaining why his software is necessary to new users. And then learn how to distinguish someone that doesn't need it.

 

[Andy Ful]

@root,
@LDogg proposed you to use some Defender ATP features which is natural because you included in your profile
Maintenance tools: Windows built-in
This advice is usually welcome to protect such activities as (from your profile):

• Financial and sensitive documents
• Downloading and installing new software(s)
• Working from home

You have already applied a good basic security setup, so simply explain to MT readers why you do not need more security. This will be helpful for many MT readers to understand your choice.

@LDogg,
It seems that @root knows what he is doing, so any advice can be irritating to him.

 

[LDogg]

"External HDDs" is plural, so there is in fact more than one. I've expanded on why the former two suggestions aren't needed.

The rest of this post is 100% opinion and is not meant to be seen as disrespectful. This place really hasn't changed over the past few years. Same copy-and-paste responses peddling niche homemade software and all. I'd happily start using extra bloat on my machine if it could be explained to me why I would need the extra bloat for my specific uses. "Please use X" isn't convincing enough for me, I'm just being told to blindly follow. It started with Appguard, then moved on to VoodooShield (look how that ended), and now we're onto the next. With that said, we have great developers on the forum, such as Andy, so do his software justice by explaining why his software is necessary to new users. And then learn how to distinguish someone that doesn't need it.

Context: I saw exactly what you had on the setup, hence why I suggested Configure Defender or alternative @Andy Ful software because I can tell you are not just a regular average home user. My replies certainly are not "copypastas" I look at detail of each setup and reply with short sentence as understandably some people don't wanna read paragraphs of words and thus being bored as the conclusion.

"so do his software justice by explaining why his software is necessary to new users" is a highly unfair strawmanned argument, as I'm replying to you, not a new user.

Now with Windows Defender then, do you have the advanced settings used or the default settings used?

With backups, I apologise, I was on about different ways, cloud backup, External HDDs (which you have) and backup solutions. I hope thos cements out the misunderstanding.

~LDogg

 

[LDogg]

However, additional post, you come off very passive aggressive when advice is given. Just a personal analysis and no way an attack on your character.

~LDogg