Advice Request Security setup for my parents

[Stopspying]

For one-time payment ad / tracker / malicious website blocking at the operating system level you can keep Adguard For Windows, get the lifetime license(s) when on sale like it often is on StackSocial et cetera, and install the free Adguard Browser Assistant in Brave Browser.

If you're going to do this start looking now on sites like this for when they start doing Black Friday deals.

 

[ForgottenSeer 97327]

My parents and wife's parents setup. Works like a charm for a few years now with zero assistance calls and zero infections.

1. Running Basic User plus setting UAC to deny unsigned processes to elevate (it is an option of SWH)
2. Don't give them the password of the admin account
3. Microsoft Defender + Configure Defender on HIGH (protected folders disabled) + SimpleWindowsHardening + Enable smartscreen for Explorer and Edge
4. Microsoft Office (buy a digital one-time license for cheap)
5. Run Edge and harden registry with regedit in HKCU (they can't change settings in Edge) and use BALANCED settings with just 1 extension MalwareBytes Browser Guard
6. Create a NEXT DNS profile for them, enabling all security features and no privacy filters (you have BrowserGuard for that)
7. Buy a large USB-disk for data backup (start the backup when you visit your parents and keep USB disk with you. so it is offline all the time) and install Syncback Free
8. Harden Explorer, Edge and Office with Microsoft Defender Exploit protection (default plus)
a) block images of low integrity
b) block external images
c) enable code integrity guard
d) disable extension points
e) enable hardware enforced stack protection
f) validate image dependency integrity
9) Disable CMD and MSHTA by enabling all protections in MD exploit protection for these two obsolete programs.
10) Disable remote stuff (support etc) by disabling these services or settings as admin.
11) Install a password manager for them
12) Use build-in mail (safer than outlook) and add their mobile account (probably gmail) to mail and agenda for syncing and install MS Outlook App on their Android device.

Don't be smart with 3rd party software or multi layered combo's, just sell your soul to Microsoft and use Andy Full's utilities to raise home user security to business level protection. When you use Microsoft Office there is no better AV than MD. Use Edge pass

 

[Gangelo]

Is Windows the only option?
If they only use the pc for web browsing, FB, email, etc. the best option is Chrome OS Flex. This is my set it and forget it solution for elders.

 

[goodjohnjr]

On the topic of DNS server it probably better to just use one that got malware protection Quad9 or Cloudflare security or possibly nextdns and keeping the ad blocking list to a minimum, the reason is DNS level ad blocking is more risky for site breakage, since browser extensions or whole pc filtering like Adguard app is able to filter ads/trackers a few ways based on domain/URL/Div on page where DNS level just block the whole domain where the extension might only block certain URL for a domain where DNS would block the whole domain.

Also if you already got ad blocking setup on the browser it's kind of redundant blocking it at DNS level as well, if you do use DNS for ad/tracking use Nextdns and keep the number on of lists to a minimum.

That is something to consider for those who do not need that extra ad blocking, thank you for sharing that; I would recommend Quad9 DNS or CleanBrowsing DNS over those other two for malicious website blocking for a completely free DNS without the limitations and no sign-up required.

 

[Stenographers]

Windows Defender, Adguard (family license $16 on stacksocial with code) or NextDns, and make sure the default browser is a Chromium variant either MS Edge, Brave or Chrome that automatically updates with no user interaction. You can add TeamViewer if you want to go down that remote route if anything happens to the computer and they need you to fix it. Anything more complicated and you're going to get many phone calls from the parents asking about a popup or setting being blocked.

I'd stray away from Teamviewer, as it in itself can be an attack vector. If you have an unrelated security incident yeah Teamviewer might be nice. But in theory for most events you could simply walk them through unplugging their router until you get there (if you live nearby.) And that way you get free food.

 

[CyberTech]

Wait wait wait, What's the specs?

 

[show-Zi]

Don't overcomplicate things

I think that's the most important thing. The kindness of those with knowledge tends to complicate things at times.

As for the specific software, various suggestions have already been posted, so I will omit it, but I recommend the bare minimum configuration.

 

[Kongo]

I'd stray away from Teamviewer, as it in itself can be an attack vector. If you have an unrelated security incident yeah Teamviewer might be nice. But in theory for most events you could simply walk them through unplugging their router until you get there (if you live nearby.) And that way you get free food.

Or simply use the portable version that doesn't add up to your attack-surface.

 

[Pixelman]

Hey everyone, I came back.

Installed KSCFree, HC hardening tools, SWH, Adguard windows with quad 9 dns, ccleaner (offline) with autocleanup for system and browser once every week, and some minor windows tweaks.

No confusing pop ups were showing up, yay!

I know I could have experimented much more, but for now I wanted to have more time with them than with the computer

Thank you all for the great solutions!

 

[ForgottenSeer 97327]

HC Tools, you mean Hard Configurator and SimpleWindowsHardening together?

 

[Pixelman]

HC Tools, you mean Hard Configurator and SimpleWindowsHardening together?

I mean some H_C hardening tools and SWH

 

[monkeylove]

Avast Free with Do Not Disturb Mode, with notifications turned off, and all options in the mode turned on

Firefox tweaked for privacy with uBlock Origin in default mode

 

[Kongo]

I mean some H_C hardening tools and SWH

Keep in mind that SRP will soon not be working on future Windows 11 builds. Are you using Windows 10?

 

[Pixelman]

Keep in mind that SRP will soon not be working on future Windows 11 builds. Are you using Windows 10?

Yes, Win10

 

[Ink]

autocleanup for system and browser once every week

There's no performance gain from deleting cookies, caches or history. I would avoid deleting browser data for this reason.