MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…
I'm curious what was the biggest issue with whitelisting. Was it about making sure services work, or about standard users' daily work? Did you try to comply on everything, or just have a PCI compliant zone? Also, do you remember what was the specific reason for failing the audit? This all sounds interesting since you've gone though that experience.
Windows 10 Enterprise ignores various privacy settings
41–50 of 269 posts
Re: Windows 10 Enterprise ignores various privacy settings
#42Since the first release of W10 several registry keys and policies have changed in very confusing ways. I can't remember what exactly but I had to change my personal scripts several times based on the changelog of other tools. Privacy and settings like default apps were also reverted (reset to default) when you updated. They installed some apps like Candy Crush Saga on Enterprise. I don't see that much of a problem he…
I can't agree with this more. A client straight up failed a PCI compliance audit, replete with daily fines, for using 10 Enterprise. They decided to pursue legal measures against MS for false claims. I really hope this gets elevated because reverting to win 7 is a solution with a short life span. The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive.
The more Microsoft degrades their viability for enterprise computing, the more market pressure will build (I think) for a different platform infrastructure.
If / when the market reaches that tipping point, the schadenfreude will be overwhelming.
Re: Windows 10 Enterprise ignores various privacy settings
#43Another year of another decade; Microsoft as dishonorable as ever.
But look, then allow you to run their database on Linux now!! It's proven time and time again that if the entire org isn't behind something, the good deeds of some get vastly overshadowed by these kind of games.
Re: Windows 10 Enterprise ignores various privacy settings
#44Earlier quoted context omitted.
I'm curious what was the biggest issue with whitelisting. Was it about making sure services work, or about standard users' daily work? Did you try to comply on everything, or just have a PCI compliant zone? Also, do you remember what was the specific reason for failing the audit? This all sounds interesting since you've gone though that experience.
Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.
Re: Windows 10 Enterprise ignores various privacy settings
#45Moreover, for some years now we have considered our Windows operating systems as 'hostile' privacy-busting code on our PCs and if there was some easy way we could get rid of them then we would do so in an instant (please don't come at me with the Linux bumph/argument because in many instances it's not a possible option).
This really is tiresome, why can't we just buy Windows/Microsoft busting routers that have a big red button on them that says: "Stop all Phone-home to Microsoft" or alternatively ones that have easily updatable blocking lists/text files that we can easily administer/download to them?
This ought to be an easy no-brainer but it isn't! Why is it that router manufacturers, etc. aren't falling all over themselves to provide such devices? I'm amazed that they're not, one would think there'd be dozens of available by now; are manufactures that timid and afraid of Microsoft that they're not game to make them?
Furthermore, it is not only a Microsoft Windows O/S problem, as these days just about all software talks home without seeking the user's permission to do so beforehand, and none of them tell you exactly what information is being transmitting home. It seems to me that we users will never solve this "talk home" problem until we have easy to use gateways that are external to our PCs, phones etc. that automatically block all "phone-home" addresses.
BTW, anyone thinking of developing such a device needs to keep in mind that for years Microsoft has hard-coded within Windows certain IP address that bypass the hosts file irrespective of how it is set so that it is impossible to block Windows completely from talking home. Thus, there is no other option other than to block these addresses by means that are external to the PC/device!
A final point: Microsoft could claim that as it has provided the upgrade to Windows 10 free and that entitles it to sap the private life info out of its users. I would counter that by saying that if alternatively I actually buy/pay for the operating system then I'm entitled to have complete control over it—and that means no talkback to Microsoft by the OS.
Of course, none of this would be a problem now if the Microsoft monopoly had been busted years ago (i.e. if our fearful democracies had been game enough to use already existing law to thwart the monopoly early on).
Re: Windows 10 Enterprise ignores various privacy settings
#46MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…
Re: Windows 10 Enterprise ignores various privacy settings
#47Proprietary operating systems work against your interests. Stop using them.
Re: Windows 10 Enterprise ignores various privacy settings
#48MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…
The LTSB edition looks promising but I haven't put it under the microscope yet.
Re: Windows 10 Enterprise ignores various privacy settings
#49Earlier quoted context omitted.
Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.
All of the first-party connections seem to have proper DNS names, even on CDN (microsoft.com, microsoft.com.akadns.net). The ad networks are obvious third party that could be dropped. I mean, there could be more stuff I didn't see, but from the screenshots, dns blackholing seems viable.
DNS/FW whitelist is the only way to have even a little confidence that egress is controlled at this point.
Re: Windows 10 Enterprise ignores various privacy settings
#50Earlier quoted context omitted.
I don't think they do it on purpose. I think Windows is just a patchwork of cruft at this point. I'm sure the Enterprise version shares all the code with the non Enterprise versions which have all the spying ... analytics... enabled, so bugs are bound to happen that let this escape into the Enterprise version.
Whether it's incompetence or malice, it's wholly unprofessional. My confidence was already shaken with MS through their entire Win 10 Campaign and it's now completely gone. Their paid support services are hit and miss and if I'm going to end up supporting things that my client is paying MS to support then they're out and my client gets a smaller TCO overall. I'll have to work with some of them so their business remai…
I've always been an MS person but am running Ubuntu on all of my devices now. I feel it hurts my productivity as lots of things I did in Windows just don't work in Ubuntu, but it's better than the alternative. I have a Windows 10 VM that I use every once in a while for those things that are completely impossible on Ubuntu.
And I'm not even sure I can trust Canonical.