Credit to DecentSecurity.com for the basis of this guide, I have updated some parts of this 2+ year old document
Windows is an enterprise-ready, highly configurable operating system and as such can take a long time to properly manage and configure.
From Microsoft’s own security documentation:
Security baselines are an essential benefit to customers because they bring together expert knowledge from Microsoft, partners, and customers.
For example, there are over 3,000 Group Policy settings for Windows 10, which does not include over 1,800 Internet Explorer 11 settings. Of these 4,800 settings, only some are security-related. Although Microsoft provides extensive guidance on different security features, exploring each one can take a long time. You would have to determine the security impact of each setting on your own. Then, you would still need to determine the appropriate value for each setting.
The best thing to do is start from the bare hardware and install Windows 10 from scratch with UEFI, TPM, and SecureBoot turned on. If you don’t want to do that, skip this section.
For best compatibility and security you should update your computer’s BIOS. A modern BIOS (really UEFI) is a full operating system that runs below and at the same time as Windows, and needs patches too! People who built computers in the early 2000’s will tell you BIOS updates are risky - and they were - but not anymore. These updates deliver fixes, features, and security updates you won’t ever hear on the news.
Even new computers/motherboards need updates. If you’re starting from scratch, do the BIOS update after installing Windows 10.
You can find the BIOS update tool on your manufacturer’s driver page for your computer model. You will need to reboot for it to take effect. If you have a Surface, BIOS updates are delivered through Windows Update.
To get ready to install Windows 10 64 bit on the bare hardware, use Microsoft’s Media Creation Tool to create a bootable DVD or USB stick.
Make sure everything is backed up before proceeding. The following changes will wipe your Windows installation.
This part is important and something few guides discuss.
From the boot of your computer, press the setup hotkey. It may be F1, F2, F8, F10, Del, or something else to get into SETUP mode. Again, BACKUP YOUR DATA.
In the BIOS:
Set a BIOS password. It can be simple, password managers don’t work here, so don’t lock yourself out. This is only to prevent malicious modification by someone in front of the computer or by a program trying to corrupt it.
Change boot to/prioritize UEFI. Disable everything except UEFI HDD and UEFI DVD (or USB UEFI if you plan on using a USB stick to install Windows) - disable all but your primary boot device after install.
Enable the TPM (if available) and SecureBoot (if available) options. This is important, as it is the underpinnings of the chain of trust in the boot process.
Disable 1394 (FireWire) and ExpressCard/PCMCIA (if you’re on a laptop) as a layer to further mitigate DMA attacks. This isn’t as important anymore, but if you don’t use them you might as well turn them off.
If you want - and if the computer offers it - you can enable a System and HDD password. We will be using BitLocker to protect the disk, but this is an extra layer you can add if you want. I don’t do this.
If you don’t use the webcam or microphone, you may be able to turn them off in the BIOS.
Save settings and shut down.
Insert your DVD/USB. Boot the computer and use the boot menu hotkey to boot to your UEFI DVD or UEFI USB. The hotkey is often F10 or F12. Search the web or manufactuer’s documentation if you can’t figure out how to get to the boot menu.
Follow the prompts and install Windows. If it gives you an option of where to install Windows to, and there’s already a partition, delete the partition first.
User Account Control (UAC) is a fundamental component of Microsoft’s overall security vision. UAC helps mitigate the impact of malware. Each app that requires the administrator access token must prompt for consent. The one exception is the relationship that exists between parent and child processes.
This means if a piece of malware attempts to use administrative priveleges to do something nasty, it has to prompt for consent. Ther are bypasses, but its still smarter to turn it on than be nihilistic about it.
Follow these instructions to set UAC to the highest option, “Always notify me.” Anything less allows any malware to instantly elevate to administrator level permissions. UAC isn’t magic, but it’s a layer you want to use.
If you have Windows 10 Home:
If you have Windows 10 Pro (best option):
Right-click on Start > Control Panel > BitLocker Drive Encryption > Turn on BitLocker
If it says you don’t have a TPM: how to use BitLocker without a TPM.
Why not use TrueCrypt/Veracrypt?
I am asked quite frequently by friends which software to use for anti-malware on Windows. This question is much easier to answer than ever before as Microsoft now has the best built-in anti-malware it has ever had, and its included with your Windows license. Windows Defender’s performance is comparable to the best products on the market. With some configuration settings and additional business features like Defender for Endpoint, Azure Sentinel, etc. (license required) it easily competes with the best enterprise tools out there.
This section is dedicated to installing and configuring a web browser. Chromium based browsers remains the standard with impressive security. Mozilla has spent years completely revamping the security model and reliability code of Firefox, it’s an extremely fast, secure choice.
Microsoft Edge, based on Chromium, is built into Windows and works well with system security controls. Personally I still prefer Brave or Firefox but Microsoft has done a good job on this new browser.
Options are great, install whichever you prefer or both:
8.1 Install Brave 64 bit Make sure Brave installs for all users so it is in a directory that requires administrative permissions to modify and is able to auto-update.
8.2 Install Firefox 64 bit Again, Firefox is a great choice for a browser. You should ensure you’re using Firefox 64-bit.
The majority of threats to users come through malicious advertisements displayed on mainstream websites. Fake pop-ups saying your computer is infected also target less technically proficient users that get tricked into calling a scam tech support company.
uBlock Origin is a fast, effective, and reputable “ad-blocking” software