Advanced Security TairikuOkami's Configuration 202x

[TairikuOkami]

Windows 11 24H2 Quiet Edition



Anti-ransomware - backup folder - denied access to SYSTEM, Users permissions are set to read only.
I turn off PC with Wise Cleaners + tweaks, to remove startup entries/policies and to restore my settings.
Browser's cache, Desktop, Downloads and Temp folders are stored in the RAMDisk, where malware likes to hide.
In case of an emergency (ransomware) I can hit Reset and Windows will boot with all those reset to the previous state.

 

[eonline]

I would like to see the extension of Malwarebytes to help more smartscreen and Nextdns. Good configuration, thank you very much for sharing.

Edit: I would try Firefox because you don't have to be sending all your navigation data to ms. I would replace Windows Repair Toolbox with FRST.

 

[TairikuOkami]

I would try Firefox because you don't have to be sending all your navigation data to ms.

I have disabled most of it via policies and NextDNS helps too.



Besides I like MS services connected to each other, thus I started to use onedrive and outlook as well.
Saved passwords within Edge are available in MS Authenticator and Edge on android is also more smooth.

I would replace Windows Repair Toolbox with FRST.

WRT contains FRST.

 

[eonline]

And any anti-exploit settings for your browser and mail client if you have it?

 

[TairikuOkami]

And any anti-exploit settings for your browser and mail client if you have it?

Exploits would have a hard time running without Powershell and WSH. I have restricted some exes (lolbins) like mshta.exe via Disallow policy. Port 80 aka http is not allowed. To partially prevent malware using legitimate processes, I have allowed only trusted IP ranges for the most vulnerable apps like svchost or discord. Process Hacker checks running processes in VirusTotal.

 

[TairikuOkami]

I started to use Brave for YouTube and LibreWolf for Facebook for security and privacy reasons. Edge seems to be a tad faster now. My ramdisk with all browser's profiles and caches takes only ~400MB. I have unlinked my real name from all other accounts except facebook, because ... the world has changed, money accounts are being seized and some opinions are considered illegal.

 

[oldschool]

@TairikuOkami do you use NextDNS client or in browser?

 

[Watarud]

Good afternoon, the author of the topic, tell me please, I was interested in your installation, how to repeat it and do it the same way as you?

 

[TairikuOkami]

Good afternoon, the author of the topic, tell me please, I was interested in your installation, how to repeat it and do it the same way as you?

My whole config is in Windows Setup 1 + Windows Setup 2 + Disable Defender + Windows Tweaks, then it is just firewall rules, like:

 

[Watarud]

My whole config is in Windows Setup 1 + Windows Setup 2 + Disable Defender + Windows Tweaks, then it is just firewall rules, like:

Thank you very much
Have a nice day)

 

[TairikuOkami]

Disabled Microsoft Editor, apparently it is something to be concerned about. So much for putting all my fate into MS.

rem 1 - The Microsoft Editor service provides enhanced spell and grammar checking for editable text fields on web pages
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "MicrosoftEditorProofingEnabled" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "MicrosoftEditorSynonymsEnabled" /t REG_DWORD /d "0" /f

 

[StRonK]

I ran the scripts you gave Windows Setup 1 + Windows Setup 2 + Windows Tweaks for trial purposes. My internet adapters are completely gone, I couldn't connect to the internet. Good thing I took a backup and restored windows from the backup

 

[oldschool]

I ran the scripts you gave Windows Setup 1 + Windows Setup 2 + Windows Tweaks for trial purposes. My internet adapters are completely gone, I couldn't connect to the internet. Good thing I took a backup and restored windows from the backup

Good thing. No one can use @TairikuOkami's setup off-the-shelf!

 

[SeriousHoax]

I ran the scripts you gave Windows Setup 1 + Windows Setup 2 + Windows Tweaks for trial purposes. My internet adapters are completely gone, I couldn't connect to the internet. Good thing I took a backup and restored windows from the backup

His tweaks are based on his requirements only, which is quite extreme. So it's normal that it doesn't work for you.
I copied his files and filtered out a lot of things based on my requirements and added to my own GitHub. So you'll have to do something like that. Consider his tweaks as a complex procedure to simplify things.

 

[TairikuOkami]

His tweaks are based on his requirements only, which is quite extreme. So it's normal that it doesn't work for you.

Well said, I never intended to share them, but people begged me to do so. My pastebin had 80k views before it was removed, after reported as malicious, thus I put warning on top.

My internet adapters are completely gone, I couldn't connect to the internet.

I disable Network Connections, since 11 deprecates it in favor of Network Connection Broker. Radio Management is needed for WiFi. I also disable DHCP Client since I setup a static IP.

EDIT: I have recently managed to enable ECH in Edge, thanks to Sampei Nihira. Runing Edge 105 with the parameter: --enable-features="EncryptedClientHello" and flag #dns-https-svcb

Good-bye ESNI, hello ECH!

A deep dive into the Encrypted Client Hello, a standard that encrypts privacy-sensitive parameters sent by the client, as part of the TLS handshake.

blog.cloudflare.com

 

[StRonK]

I disable Network Connections, since 11 deprecates it in favor of Network Connection Broker. Radio Management is needed for WiFi. I also disable DHCP Client since I setup a static IP.

Really interesting, I thought the code wasn't working for me, actually I didn't think you disabled it on purpose. As far as I know, it is not possible to connect to the internet without an internet adapter, how do you connect to the internet? Also what is the code that disables internet adapters? if i remove it from the codes, i think i can use the codes you gave, normally your codes worked fine for me. thank you

 

[TairikuOkami]

As far as I know, it is not possible to connect to the internet without an internet adapter, how do you connect to the internet?

Actually when you setup IP/DNS manually and then disable "Network Store Interface Service", it will disable all network services, thus all network "optimizations" and you will get a rock solid connection. It will make Windows think that there is no internet, so will also get zero telemetry. But as the result, it disables windows updates, windows firewall and so on.

Also what is the code that disables internet adapters?

You can just run this, it will reset network and network services.

Windows/Windows Network Fix.bat at main · TairikuOokami/Windows

Windows. Contribute to TairikuOokami/Windows development by creating an account on GitHub.

github.com

I didn't think you disabled it on purpose.

I am trying to disable/block anything that could be possibly malicious. Even Windows boot logo can be dangerous.

Backdoor Malware Hidden Inside Windows Logo Image

Security researchers have recently discovered a new malicious campaign by the “Witchetty” hacking group. The threat actors used steganography to hide a backdoor malware in a Windows logo

heimdalsecurity.com

bcdedit /set {globalsettings} custom:16000067 true
bcdedit /set {globalsettings} custom:16000068 true
bcdedit /set {globalsettings} custom:16000069 true

 

[StRonK]

Actually when you setup IP/DNS manually and then disable "Network Store Interface Service", it will disable all network services, thus all network "optimizations" and you will get a rock solid connection. It will make Windows think that there is no internet, so will also get zero telemetry. But as the result, it disables windows updates, windows firewall and so on.

I will try to do what you said, I hope I will be successful.

You can just run this, it will reset network and network services.

thank you

I am trying to disable/block anything that could be possibly malicious. Even Windows boot logo can be dangerous.

It's unbelievable, I didn't know something like this could happen. Today I realized once again how ignorant I was about security. Before I joined this forum, I thought security was just about installing antivirus and that anti virus would protect me from everything. I understand that I need to be much more careful, I am grateful to you for the information you have given. thank you for everything.

 

[TairikuOkami]

Just did some quick testing and I was quite surprised. I was expecting exploit protections to lower perfomance, but it was the other way around, I got noticable stuttering without them.

NoAV, Disabled everything: SecureBoot, TPM, Exploit Protections (CFG, DEP, SEHOP, ASLR)


NoAV, all security enabled, standalone TPM (the best result)


NoAV, all security enabled, plus enabled Spectre (the worst)


Defender, all security enabled


Adaware, all security enabled


So disabling Spectre mitigations is definitelly worth it on AMD.

GRC | InSpectre

InSpectre - Inspect Windows Meltdown and Spectre Vulnerability

www.grc.com

 

[TairikuOkami]

I have finally figured out, how to install Panda, I have to unpack an offline installer and run setup.exe, not in temp though.
I do not need nor want AV, but Windows 11 does, it causes an unpredictable behaviour without AV, I better keep a light one.

Besides, the tray icon looks really neat and it fits the overall GUI.