3 ms·
The only way to use Windows 10 truly securely is by running it in a QEMU virtual machine as a guest with local-only networking for QEMU native Samba file sharin
by orangepurple 5y ago
The only way to use Windows 10 truly securely is by running it in a QEMU virtual machine as a guest with local-only networking for QEMU native Samba file sharing between host and guest. Zero internet connectivity. Booted off what QEMU calls a temporary snapshot after setting everything up on the base QCOW2 image. This way any changes to the virtual drive after boot are trashed after shutdown. This solution is robust and reliable.
- uuyi 5y agoCan you actually do an airgapped Windows install these days? I used to work in the defence sector in the days of Windows 2000 and that was easy but I have no idea how it works since. Our corporate stuff is all remotely managed with InTune and all sorts of horrible shit that hammers the network all day.
- orangepurple 5y agoThe Windows 10 installation ISO downloaded directly from microsoft.com does not need the internet to install correctly under any circumstances. You also don't need to do anything special to get it working. However, I opted for the inclusion of a completely optional disk driver during install time to improve performance and sustainability. You can provide a QEMU virtual CDROM with drivers during installation if necessary, and do the rest of your setup with QEMU native Samba file transfers followed by software installation. I use the QEMU virtual CDROM to provide VirtIO drivers during Windows installation for super fast virtual drive I/O and DISCARD support. -drive file=windows.qcow2,index=0,media=disk,if=virtio,discard=unmap discard=unmap is absolutely essential to keep your QEMU QCOW2 file on your host from growing excessively as you delete stuff in your Windows guest. This is the main reason I use VirtIO. To learn more about QEMU I recommend the Arch Wiki page on it