Windows 11 x64 security hardening guide
github.com
Windows 11 x64 security hardening guide
1–10 of 55 posts
Re: Windows 11 x64 security hardening guide
#2No post body was provided.
Re: Windows 11 x64 security hardening guide
#3Interesting list. Any idea of the 'why' behind this?
> No "Tuning" tools (not even stuff like Ccleaner!)
Also what is a better alternative to 7zip
> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
Re: Windows 11 x64 security hardening guide
#4Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
> Any idea of the 'why' behind this?
I'm pretty curious, too
> Also what is a better alternative to 7zip
is 7zip necessary nowadays? can the built in zip/unzip feature be enough?
Re: Windows 11 x64 security hardening guide
#5Quoted post unavailable.
In a business environmeny many of those configs can be automated either using GPOs or Intune/ MDM.
Re: Windows 11 x64 security hardening guide
#6> create another Admin account and transform your current one to limited/ restricted/ standard user account to reduce the attack surface enormously. Don't use Admin account for your tasks!
It's crazy how Windows doesn't have a sane way for users to became administrators temporarily. LAPS is a weird hack and Azure PIM doesn't work for local admin.
Re: Windows 11 x64 security hardening guide
#7Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
> Any idea of the 'why' behind this? I'm pretty curious, too > Also what is a better alternative to 7zip is 7zip necessary nowadays? can the built in zip/unzip feature be enough?
The built in one only supports .zip format AFAIK. 7zip supports basically everything you will come across including .rar and .gz. Also it’s nice to have the Explorer shortcuts (right click, unzip here).
Re: Windows 11 x64 security hardening guide
#8Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
MOTW support has been introduced in v22.00 [1]:
>- New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu.
Re: Windows 11 x64 security hardening guide
#9Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support) MOTW support has been introduced in v22.00 [1]: >- New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. [1] https://www.7-zip.org/history.txt
[deleted]
Re: Windows 11 x64 security hardening guide
#10Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
The entire list can be summarized into "Just use the latest versions of Microsoft everything, and uninstall all 3rd party software" (how convenient, I bet they also recommend using OneDrive). They even explicitly recommend against any 3rd party security software.
Yet however 7-zip gets the boot because it apparently is not compatible with a 3rd party "Anti-Exploit" software (Malwarebytes) ?