Advanced Security TairikuOkami's Configuration 202x

zkSnark · Mar 4, 2023

TairikuOkami said:
Windows 11 22H2 Silent Edition

View attachment 266772

Anti-ransomware - backup folder - denied access to SYSTEM, Users permissions are set to read only.
I turn off PC with Wise Cleaners + tweaks, to remove startup entries/policies and to restore my settings.
Browser's cache, Desktop, Downloads and Temp folders are stored in the RAMDisk, where malware likes to hide.
In case of an emergency (ransomware) I can hit Reset and Windows will boot with all those reset to the previous state.

I just came to know about RAMDisk and Googling trying to learn more about it. My laptop has 16GB RAM and 4GB AMD Graphics. What GB should I allocate for RAMDisk?

TairikuOkami · Mar 4, 2023

zkSnark said:
What GB should I allocate for RAMDisk?

ImDisk can allocate RAM dynamically, so as much or as little as needed. I have it set to 20GB max, but it ussually uses only about 1GB. In your case I would try 4GB max for starters.

Ink · Mar 4, 2023

zkSnark said:
I just came to know about RAMDisk and Googling trying to learn more about it. My laptop has 16GB RAM and 4GB AMD Graphics. What GB should I allocate for RAMDisk?

"The amount of RAM you should allocate for a RAMDisk depends on several factors, including your overall RAM usage and the size of the files you plan to store on the RAMDisk. As a general rule, it's recommended to allocate no more than 25% to 30% of your total RAM to a RAMDisk. For a laptop with 16GB RAM, you can allocate around 4GB-5GB for the RAMDisk. However, keep in mind that allocating too much RAM to a RAMDisk can affect your system's performance, so it's important to experiment with different amounts to find what works best for you."

Source: AI-powered Reply
Mod note: testing it's function.

zkSnark · Mar 4, 2023

TairikuOkami said:
ImDisk can allocate RAM dynamically, so as much or as little as needed. I have it set to 20GB max, but it ussually uses only about 1GB. In your case I would try 4GB max for starters.

Found this article which says OSFMount is the fastest one. Have you tried OSF too? How is it compared to ImDisk?

RAM Disk Software: 11 Best Free Tools We Tested

RAM Disks can be very useful and if you have the memory available, using system RAM as a disk drive can really speed up certain operations. One common

www.raymond.cc

zkSnark · Mar 4, 2023

Ink said:
"The amount of RAM you should allocate for a RAMDisk depends on several factors, including your overall RAM usage and the size of the files you plan to store on the RAMDisk. As a general rule, it's recommended to allocate no more than 25% to 30% of your total RAM to a RAMDisk. For a laptop with 16GB RAM, you can allocate around 4GB-5GB for the RAMDisk. However, keep in mind that allocating too much RAM to a RAMDisk can affect your system's performance, so it's important to experiment with different amounts to find what works best for you."

Source: AI-powered Reply
Mod note: testing it's function.

OpenAI ChatGPT?

TairikuOkami · Mar 4, 2023

zkSnark said:
Found this article which says OSFMount is the fastest one. Have you tried OSF too? How is it compared to ImDisk?[/URL]

I have tried several paid/trial versions and they are indeed noticeably faster (Softperfect). I was under impression that RAM speed is the limitation, but obviously the driver/software matters too.
I have not tried OSFMount though, I used AMD ramdisk before, but it has not been updated for years, so I moved on, but since everything is working, I do not tempt the fate but testing too much.

TairikuOkami · May 4, 2024

That is it. I am done with Edge password manager. It recently removed some useful features, like categories and also the ability to edit links, but I was like OK, it is MS, it was expected, I blame it on outsourcing. But I was just testing the policy ClearBrowsingDataOnExit, because CookieAutodelete is dead, and it removed all passwords. No problem, it happened before, passwords will sync back, but they did not and on top of it, it removed them from all devices, including MS Authenticator. WTF?! What saved me was having a backup of "Login Data" file. So I moved back to Bitwarden and as if that was not bad enough, I sort of "forgot" the new password, so once I spent an hour adding 111 passwords, I had to do it all over again. What a lovely spent weekend. Thank you MS.

TairikuOkami · Oct 3, 2024

I have finally managed to enable DoT on 24H2, boy was that "easy" and I struggled for months.

PoC (I use NextDNS with a custom link which caused me trouble, CloudFlare is just for verification):

Code:

netsh dns set global doh=no
netsh dns add global dot=yes

netsh dns add encryption server=1.1.1.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no
netsh dns add encryption server=1.0.0.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no

SeriousHoax · Oct 9, 2024

TairikuOkami said:
I have finally managed to enable DoT on 24H2, boy was that "easy" and I struggled for months.
PoC (I use NextDNS with a custom link which caused me trouble, CloudFlare is just for verification):

Code:

netsh dns set global doh=no netsh dns add global dot=yes netsh dns add encryption server=1.1.1.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no netsh dns add encryption server=1.0.0.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no

View attachment 285663

Good to know that DOT is also supported. Curious why are you choosing DOT over DoH? Is it because of speed? Apparently, in theory DoT is slightly faster than DoH, DoQ is faster than both as QUIC is UDP.
BTW, if Edge's (and other chromium browsers) DNS setting is not changed then it doesn't work with Windows's DoH. I see the same in 24H2. Does it work with DoT?

TairikuOkami · Oct 9, 2024

SeriousHoax said:
Curious why are you choosing DOT over DoH?

I consider it safer based on what I have read. People choose DoH, because it is supposedly hidden from ISP as if ISP does not know IPs of DNS, so it does not really matter in that case.

SeriousHoax said:
BTW, if Edge's (and other chromium browsers) DNS setting is not changed then it doesn't work with Windows's DoH. I see the same in 24H2. Does it work with DoT?

DoH and DoT in chromium browsers work just fine, as long as the insecure DNS is blocked in the firewall, causing 5 sec lag every 5 min, but that is a small price to pay for security and privacy.

SeriousHoax · Oct 9, 2024

TairikuOkami said:
I consider it safer based on what I have read. People choose DoH, because it is supposedly hidden from ISP as if ISP does not know IPs of DNS, so it does not really matter in that case.

DoH and DoT in chromium browsers work just fine, as long as the insecure DNS is blocked in the firewall, causing 5 sec lag every 5 min, but that is a small price to pay for security and privacy.

View attachment 285734 View attachment 285735 View attachment 285736

I see. It's just that Chromium browsers are somehow incompatible with Windows's internal DoH. They work by default just fine when YogaDNS or AdGuard Home is run locally.

oldschool · Oct 9, 2024

@SeriousHoax Check this out if you haven't already seen it.

Enable DNS over TLS (DoT) in Windows 11 Tutorial

This tutorial will show you how to change your DNS Server address and enable DNS over TLS (DoT) in Windows 11. A DNS (Domain Name System) server is the service that makes it possible for you to open a web browser, type a domain name and load your favorite websites. DNS over HTTPS (DoH) is a...

www.elevenforum.com

Setting up DOT Wifi is way too much work.

TairikuOkami · Oct 26, 2024

I have decided to remove WFC, it was giving me too much headache. Windows Firewall with outbound allowed still honors block rules, so I am just going to block bad ports by default like:

Code:

netsh advfirewall firewall delete rule name=all
netsh advfirewall firewall add rule name="TCP Block" dir=out action=block protocol=TCP remoteport=1-79,81-442,444-852,854-1024
netsh advfirewall firewall add rule name="UDP Block" dir=out action=block protocol=UDP remoteport=1-442,444-1024
netsh advfirewall firewall add rule name="Brave TCP" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="C:\Users\Tairi\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe"
netsh advfirewall firewall add rule name="Edge TCP" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
netsh advfirewall firewall add rule name="Edge UDP" dir=out action=block protocol=UDP remoteport=443 program="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
netsh advfirewall firewall add rule name="LibreWolf TCP" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="C:\Program Files\LibreWolf\librewolf.exe"
netsh advfirewall firewall add rule name="LibreWolf UDP" dir=out action=block protocol=UDP remoteport=443 program="C:\Program Files\LibreWolf\librewolf.exe"
netsh advfirewall firewall add rule name="OneDrive TCP" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="C:\Program Files\Microsoft OneDrive\OneDrive.exe"
netsh advfirewall firewall add rule name="IceDrive TCP" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="C:\Users\Tairi\AppData\Local\Temp\IcedrivePortable\Icedrive.exe"

Search

Advanced Security TairikuOkami's Configuration 202x

Showcase - TairikuOkami's PC built in 2024

Looking for medium feedback.

zkSnark

Level 5

TairikuOkami

Level 37

Attachments

Ink

Administrator

zkSnark

Level 5

RAM Disk Software: 11 Best Free Tools We Tested

zkSnark

Level 5

TairikuOkami

Level 37

TairikuOkami

Level 37

TairikuOkami

Level 37

SeriousHoax

Level 49

TairikuOkami

Level 37

SeriousHoax

Level 49

oldschool

Level 84

Enable DNS over TLS (DoT) in Windows 11 Tutorial

TairikuOkami

Level 37

Similar threads