Hardening a school laptop running W10

I'm going to have to use a windows 10 laptop for the next few years at my university and I would like to strip out the microsoft telemetry and take some preemptive measures just in case it gets stolen down the line. I'm unfamiliar with W10 or hardening mobile devices in general, and it's hard to get reliable info about this online since here's so much bad or sketchy information online. I've heard people recommend Prey for device tracking and recovery but I feel iffy about installing literal tracking software that could potentially be turned against me. Does anyone here have experience with it or have any suggestions on what I need to do to make windows 10 less soykafty?

>>5970 Windows 7 i can probably help you, but win10 i know jacksoykaf about, i had a win10 machine a couple years ago and i tried to debotnet it as much as possible without success, until i had enough and installed linux on it. >measures for stealing install veracrypt and encrypt your HDD, that's all you can do to if you don't want a thief tracker in your PC

https://gist.github.com/CHEF-KOCH/fff6b236292216f358fd5f05c792848c

>Prey I'm unfamiliar. The approach I'd take is to make a simple reverse tunnel to a server I own whenever the computer is turned on. Leave a guest account open so that dumb thieves will hook it up to wifi and let it phone home. I guess if you wanted it to be more sophisticated you could figure out a way to have it autojoin open wifi networks or your ISP's hotspots. Once you have remote access, it shouldn't be too tough to catch the thief (screenshots, webcam pictures, network logs, etc.). The caveat here is that a thief with any amount of technical knowledge wouldn't be stupid enough to boot the computer without removing the hard drive.

Make a custom .iso using WinReducer to get rid of bloatware like Cortana. If you want to have both Windows and Linux using partitions i recommend EasyBCD 2.3

Depends on your threat model. If your threat model includes government actors or pervasive surveillance there is no reliable way to 'de botnet' proprietary software. If you have real interest in avoiding government actors or pervasive surveillance, avoiding proprietary software is essential. Consider virtualization of W10, and alternatives to apps you might need. Alternatively, consider a single purpose 'school laptop' that you use exclusively for what must be done at school. Much less securely, consider a dual boot (You accept risk W10 may interfer with your other OS's - mitigate to an extent by FDE). If your threat model doesn't include governments or pervasive surveillance, use Windows 10. Its theoretically a modern hardened operating system. Trying to 'de botnet Windows 10' is comical and applying a patch to what you can see. There are tens of millions of lines of code across decades, all provided in binary only format. There is no enough resources to reverse engineer Windows 10 and ensure its been 'de botnet'ed.

>>6237 microsoft and us federal government have full access to windows 10, but nobody ever seems to ask "what about other threats". say someone is the most bootlicking diehard patriot in the country and trusts us-based actors completely, should he REALLY still use windows 10? In such a bloated, vulnerability-laden OS, surely there are plenty of examples of viruses or exploits that give an attacker like Indian or dimitri, etc. access to your personal data without any phishing needed, free to run a cryptolocker, keylogger, etc, or even just something like sniffing the data sent to Microsoft servers. So why doesn't that seem more common? Does it happen and nobody hears about it?

If you cannot dual boot the machine, consider running a live system like Tails or Slax. Any of the telemetry blockers or tools to rip things out of Windows likely make it worse and/or more identifiable - don't attempt to disable updates either; that hurts more than it helps. If you 100% must use Win10, it's fairly easy to go through the settings and toggle off most annoyances and make it fairly usable.

Use a strong password, enable BitLocker, make regular backups, and disable telemetry. If you're just using it for school and are worried about it getting stolen that should be enough.

What other lainons above said, you can't de-botnet completely. I do however recommend Blackbird, it removes a considerable amount of telemetry and bloat.