Securing windows 11

I know the kneejerk reaction -- "it's a fool's game". Well, I'm a fool, and I want to know how to play the game. My girlfriend recently got a new PC and there is no way in hell I'm going to convince her to try linux, so I'm setting up windows 11 to be a) as ad-free as possible b) as privacy-friendly as possible c) as de-bloated as possible and d) as user-friendly as possible. Anyone got some hot tips? I've already done all the obvious stuff and watched a couple "windows privacy" videos on youtube, but I assume there's a lot of stuff that can only be changed by either using regedit or gpedit. I haven't used a windows PC as a daily driver in years (only boot up VM's occasionally for gaming) and I have never used Windows 11 before.

windows 11 home or pro/enterprise/something? pro and above have group policy what makes some things easy. most basic advice i can give is "install simplewall[1] and deny any connections for applications that do not need internet" if you host your own dns server, blocking some domains listed here[2] MAY help, but should only be used if simplewall does not work. it would also help if you tell what your gf typically does on her pc, if she just browses the web then only unblocking browser would be enough. also tell her if something does not work (because blocked by firewall) just ask you about it and check for any obvious stuff (example: updates do not work -> allow windows update). [1]https://www.henrypp.org/product/simplewall [2]https://docs.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints and https://docs.microsoft.com/en-us/windows/privacy/windows-11-endpoints-non-enterprise-editions

>>20067 There aren't any good scripts for debloating Botnet 11 (that I'm aware of). Use the settings GUI to disable as much telemetry as you can. Then use PowersHell to get a list of installed AppX crap: get-appxpackage -allusers * And remove them using remove-appxpackage After this, you should set up a hosts file that blocks unwanted stuff. >and there is no way in hell I'm going to convince her to try linux, You could just boot a Xubuntu Live USB and actually *show* how easy it is to use. Show her that normal stuff just works. Then offer to make a dual-boot setup.

>>20074 for new users, I think Linux Mint is a better introduction, it looks just like good old window 10 but green.

>>20074 >you should set up a hosts file that blocks unwanted stuff. windows 10/11 does not allow you to modify hosts file, the anti-virus just reverts it the reason is because that method CAN be used by malicious persons, but difference between malicious and non malicious person may not be as clear as it sounds like yes, this is reality, i am not making this up also windows since xp service pack 2 contains list of hardcoded domains that hosts file can not block, see some dns related dll (which name i do not remember rn) with hex editor for proof

>>20080 c:\windows\system32\dnsapi.dll

>>20072 >windows 11 home or pro/enterprise/something? pro and above have group policy what makes some things easy. Actually you can enable group policy on windows 11 home, it's a simple 2-line batch script. https://windowsreport.com/enable-gpedit-windows-11/ it's how I disabled Cortana and fixed the windows update settings so they won't bother her. >it would also help if you tell what your gf typically does on her pc, if she just browses the web then only unblocking browser would be enough. web browsing, gaming, art, school. It will probably be her only computer for the next few years. >>20074 >You could just boot a Xubuntu Live USB and actually *show* how easy it is to use. that's a good idea. The main problem is, she has one paint program which is windows only, which is the main reason she isn't interested in trying Linux. If I do try to get her set up, I would need to get virtual machines working with passthrough support.

>>20067 use WPD to debloat it https://wpd.app/

>>20080 What? You can manually edit host file in w10.

>>20085 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=settingsmodifier%3awin32%2fpossiblehostsfilehijack the official solution is excluding hosts file from defender: https://support.microsoft.com/en-us/topic/hosts-file-is-detected-as-malware-in-windows-defender-4320fa8b-0d54-1129-db85-61f095144521

>>20083 >WPD is it open source?

I just installed windows today and I'm looking to go full debotnet on it. Can I overwrite my Intel Ethernet controller firmware to block Microsoft in my bios?

> Debotnetting Windows This is near impossible. Unlike ungoogled chromium (which is still soykaf anyways), the problems that Windows has is all the way down to the kernel level. On top of that, Windows is closed source so editing the kernel will be extremely difficult if not downright impossible. Nonetheless, I wish you the best of luck in this endeavour lain. Maybe take inspiration from Windows XP, before it all went bad. Make some comparisons.

>>20096 >Unlike ungoogled chromium (which is still soykaf anyways) Not OP, but why is ungoogled chromium so bad?

>>20097 the google services are such a huge part of chromium that stripping them out produces a third rate browser experience. you end up with all the soykafty anti-user changes that google adds to chromium, without any of the benefits of the google services. its also a constant uphill battle. google adds floc, they need to strip it. google adds manifest v3, they need to maintain v2. overtime ungoogled chromium will either collapse or have to maintain a totally different fork

>>20093 >Can I overwrite my Intel Ethernet controller firmware to block Microsoft in my bios? The whole networking stack is in the operating system. The only thing the firmware does is covert bytes in RAM to electrical signals on a copper wire and vice versa. You can run windows inside a virtual machine or put a non-windows physical machine between windows and the network and filter packets there. If you think you know all the domains and IP addresses that need to be blocked.

>>20093 We had this exact same thread yesterday --> https://www.lainchan.org/sec/res/20067.html On Botnet 10, you can use something like this --> https://github.com/Sycnex/Windows10Debloater >I just installed windows today and I'm looking to go full debotnet on it. You can't remove the botnet from Windows. Install Linux (Xubuntu, Debian, Void, Arch, Gentoo).

Look up "0x0 Shutup", use a pi-hole as a DNS server and just block the everything Microsoft and just allow what you need, like updates and maybe some office365 apps if you're a student. If she just likes the Microsoft feel but you want her to use Linux then try Zorin OS, just doen't use Microsoft soykaf. Teach her how to use the package manager or some GUI, whatever they use. I just do Arch so in my case pamac would be the Arch example. though you could just teach her how to use the CLI package manager, tell her it's just like googling for the software you want, just without ads

>>20067 I genuinely feel sorry for normal people because Windows 10 and 11 are such a fuarrrking nightmare to use. Like how the fuarrrk are moms and seniors supposed to navigate this crap os?

>>20075 That or ZorinOS. That soykafs pretty as fuarrrk. Having practically the only nice UI would probably do a lot for a casual user. Plus you can change it immediately to look how you want. Even like Mac OS

Microsoft lets you disable the telemetry if you're on the enterprise version. First, search activation in your start menu and enter this product key to switch to enterprise: NPPR9-FWDCX-D2C8J-H872K-2YT43 (Here is where I got that from: https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys) Windows will say it's no longer activated, but don't worry. Just use Microsoft Activation Scripts to permanently crack/activate it again: https://github.com/massgravel/Microsoft-Activation-Scripts Now that you're on an activated version of enterprise press "Win + R" and type "gpedit.msc". Navigate to "Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds" then double click "Allow Diagnostic Data". Set it to enabled and select "Diagnostic data off (not recommended)". Beyond that, there's a lot of stuff you can disable with this tool: https://www.oo-software.com/en/shutup10 I liked how it let me disable searching Bing when I searched for something in the start menu.

>>20198 You recommend enterprise, yet also MAS scripts i think that education would be better suited for that situation, it is just enterprise with different license (as seen on your image, "This value is only supported on enterprise, EDUCATION and server editions."

>>20067 idk if youre still around OP but ChrisTitusTech has made many videos on debloating windows and even made his own debloating script that is pretty good and stripping windows down to the bare essentials for usability

>>20198 Do they really allow it now? They didn't allow this back in windows 7. I tried with both 8/7 and they would either get flipped by task schedules or the option would be greyed out. Education edition (EE) would be terrible if telemetry was default since most of these guys are probably ones writing technical soykaf about some groundbreaking billion-dollar ideas. I can guess why, the oil is blood for these companies and they won't turn this off by default. "Diagnostics" is a wide term, some random crash can leak what ideas/rnd you're working with along with the crash dump.

>>20186 how do i get the pure windows 10 interface on gnome? i liked the movable blocky start menu is there a conky plugin for this >>20067 how the heck do i get windows 10 down to 2gb or better yet 1gb of ram without too much compromise as i want to keep most of the features available on my system sincec it consumes 4gb ram by default on my low end laptop >>20072 >use a damm firewall what about turning the telementery components itself OFF from the start? system still consumes small amounts of cpu whenever it tries to probe their servers what if one day the OS freezes itself due to unreachable online MS services? like what happened to mac exe hashing verification due to some undocumented features on the win kernel

>>20402 It is better not to fight with Gnome defaults, if you want a blocky menu there are other alternatives (for example KDE Plasma).

God I hate that bottom task bar and auto hide. It often or actually almost all the time covers key inputs, like shell and chat prompts, etc. Blind root shell, that's what I love!

>>20067 I debloated my 10 install manually by basically booting into a linux install and then manually deleting core system files responsible for Microsofts invasive bullcrap. I removed cortana, edge, the entire windows search function (because every time you even so much as click on the bottom task bar windows, more specifically windows search, will automatically connect to half a dozen random IPs across the entire continental US.) I can only assume it's logging your entire partition and all your files because why the fuarrrk do I need to connect to a bunch of random MS servers when I just wanna look through locally saved pictures or something? fuarrrk off with that crap. This process took me a long time because when you finally think you've won you do a quick network audit or just go check on something you changed only to find they reverted your change or theres some other service connecting to random crap and you have to go in and remove it. Before I did all this I also manually disabled all updates, windows medic service, etc. It's honestly such a hassle. It does work, works damn well but the lesson I've learned from this is basically if you're going to use windows you might as well just embrace the botnet entirely and simply isolate your activities across machines. I basically only use that desktop for gaming and youtube even though as far as I can tell it seems to be barebones now. If it's someone elses computer, or worse a normal people computer, theres almost no point in bothering because to truly debloat and debotnet a windows machine you're going to have to cripple a majority of the core functionality, there's just no other way to really do it because ms is baking in these privacy violating programs into parts of the system that you almost cant live without. For example I have 0 search functionality on that install now, the start menu has no search, I have to use the run command if I wanna quickly run something, I cannot type anything into the file search to look for a saved file, the functions had to be entirely removed because I cant go in to that specific installed program and manually edit part of it's functionality to stop it from doing whatever it is Microsoft has designed it to do. and all this was windows 10. Not 11. I can only imagine 11 is even worse and I would consider 10 borderline unusable garbage.

>>20093 What you have to do is plug some activated copper cords into the Mainframe Port Controller of your Motherboard (every build has one) and send 9707 volts through it for 14 minutes, while retaining a steady breathing pace. This will kill the botnet operating out of your Windows machine.

For real though, you can't untbotnet Windows 11, since it's designed from scratch to be hooked up to the botnet. Others posters have said as much. It's best just to not use it, because it's a nigger piece of software designed by niggers for niggerusers.

not related but don't you begin to understand the problem is actually in having a girlfriend? >>23042 lately i have been extremely pissed off with american corporate software to the point i actually started to have a huge grudge against americans and their soykafware. such a fuarrrking unusable crap. i am not sure the problem is with them being americans, but there is something to the nationality that fuarrrking drives me mad.

Any time I debloated windows 10 i would run into weird glitches, not so bad under LTSC and actually I have no problems with LTSC at this point in it’s lifecycle which isn’t surprising given its maturity. I would just run windows 10 ltsc and switch to window 11 ltsc equiv when it comes out and has had some time to get an update. Download trial versions from the microsoft website and there are instructions for using the tools that come with it to the full version by changing the SKU after that then you can activate it off a KMS “emulator”

>>23061 Perhaps the trend of centralizing software control is being pioneered in America, but it's definitely going on worldwide. I think it's just the NWO-agenda being pushed through all means possible.

try using https://getblackbird.net. it's not free software, so I don't trust it really, but it works great. >Block Windows spyware, on both the application and network level, without editing the HOSTS file or firewall settings and remove all Windows telemetry updates. >Remove all Windows built-in advertising and any preinstalled app you want. >Prevent diagnostic data, passwords, contacts, URL, SMS, handwritting, location, and P2P-update sharing. Remove all unique ID tracking tokens.

Check out windows debloating tool by chris titus. Trust him or not is up to you, of course. I used it before, worked fine.

>>23118 this is totally a web site you can fully trust world is so wonderful for having so many people that would just help you out with the windows thing completely for free

>>23061 I feel the same way. I absolutely hate being from here and having to deal with all of the soykaf. I try to avoid using anything american whenever possible.

>>23028 >For example I have 0 search functionality on that install now Just run Everything Search for that. https://www.voidtools.com/ It's invaluable -- I keep it on global hotkey and even use it as a launch bar. Instant (<0.1s) search across TBs. Any part of file or folder name, it's great.

They want you to use windows for sell their subscriptions so bullshit so windows will get more tied to internet and trying to claim your pc only for it ( secure booting ). It will only get worse with time. If you simply not like windows calling home try to block microsoft domains in your router or pihole , but you will get out of luck soon also: Windows 11 comes with new options for secure dns, so they could bypass any try to block them, so even if you unplug the cable is possible internet been a must in the future for sell you soykaf. The battle will be lost without software modifications.