3 ms·
I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Sec
by encryptluks2 4y ago
I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Security Compliance Toolkit and re-imported to other machines. Another option is PowerShell Desired State Configuration which you can then use to backup your local GPO into a MOF file, and reapplied to multiple machines or even added as part of an unattended setup:
https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/gpo-quickstart https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/...
I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.
- themenomen 4y agoAren't many of those only available in pro/enterprise versions of Windows?
- encryptluks2 4y agoYes and no... The gpedit.msc isn't included by default in Windows Home Edition, but it can easily be added: https://windowsreport.com/enable-gpedit-windows-11/ https://windowsreport.com/enable-gpedit-windows-11/
- Tijdreiziger 4y agoDo you have any suggestions for privacy-enhancing GPOs?
- encryptluks2 4y agoThere are too many to really point out any in particular. Here is an LGPO text file for my machine policies. These can be converted to a Policy Analyzer .PolicyRules file using LGPO.exe I believe to get more input as to what they are used for. You also have to add those policy templates (ADMX), which I have a few added for Zoom, Chrome, Firefox, LibreOffice, Office, Edge, etc. https://dpaste.com/ARRBCVVXN https://dpaste.com/ARRBCVVXN
- Tijdreiziger 4y agoThanks!
- layer8 4y agoCan you explain how policies are better? They generally just cause registry entries to be written, don’t they?
- encryptluks2 4y agoThey are not just written to the registry but stored in a .pol file, and not all policies are easily managed via the registry. There are hundreds of policies that impact security and privacy. With policies you can easily print a report of what is changed with descriptions, and see deprecated policies or misconfigured ones. I'd recommend anyone to try it out and see the difference for themselves as to why it is much easier to manage these using local group policies vs a bunch of registry entries.