4 ms·
I preconfigure all windows machines in my family, and take away their local admin rights. No crapware installs, no disabling of updates or defender. No microsof
by nopcode 4y ago
I preconfigure all windows machines in my family, and take away their local admin rights. No crapware installs, no disabling of updates or defender. No microsoft accounts.
They get firefox browser with adblocker preinstalled. I manage their important passwords (eg fastmail) and trained them to rely on firefox sync for the recoverable accounts.
I use MeshCentral for remote
administration (amt)… its amazing for the price (free).
OPNsense firewall in all the homes. Unknown devices are isolated and egress over wireguard VPN.
- bobkazamakis 4y agoa physical jail cell and a faraday cage and you'll only need to tighten the chains a little more!
- nopcode 4y agoTwo of the four homes already have a faraday cage :) It was built by a german chemicals company and the reinforced concrete blocks signals.
- ortusdux 4y agoI rented a place where the walls were lined with chicken wire. They used it to hold the plaster to the lath. I ended up needing to run a POE wifi AP to each room. When I moved out I told the landlord that he should use it as a selling point, as some people in the area had just tried (and failed) to sue the library for not respecting their wifi allergy.
- jackallis 4y agothis got me rolling on the floor,lol.
- orev 4y agoYou may be surprised to learn that removing admin rights is no longer (and never really did) protect against app installs. Many developers have figured out they can just install into the user’s profile. Only apps that truly need admin rights (that install services, etc.) would be blocked. Everything else is wide open. The admin rights restriction on app installs was almost just a convention that people followed. Now that the app incentives have changed (malicious apps don’t try to take over the machine anymore, they just try to steal your data), admin rights restrictions are becoming irrelevant.
- dhimes 4y agoNot OP, but I'm surprised. So thank you.
- stedaniels 4y agoNote however this is only partially true for single user devices, where lack of admin rights does prevent some attacker persistence, and is not at all true for multi user devices e.g. the shared family PC.
- orev 4y agoI’m not following which part you’re saying is untrue. The number of users on the machine is irrelevant as each user can install apps into their own user profile. Maybe they won’t have access to the other users’ data, but it’s enough to gain a foothold. Persistence is easy enough with startup shortcuts or scheduled tasks in each profile. Also, I’m not saying these apps have some kind of hidden malware, I’m saying they are operating as designed, and usually offer features in exchange for letting them do things like upload your address book, etc.
- heavyset_go 4y agoFirefox Sync is great for this. It's essentially a password manager, and if you install it on Android, you can use it as the default login information autofill app.
- Darmody 4y ago> No microsoft accounts. Good look with that from now on.
- TacticalCoder 4y ago"good luck" you mean? I'm asking because I do exactly the same: no admin accounts for my family on their own Windows machine (mother in law and wife etc.). They're also using only local account. Is Microsoft banning local accounts?
- Darmody 4y agoYes, they're removing local accounts. At least in Windows Home. A Microsoft account and an internet connection will be required to use Windows.