A guide to the hardening of the Windows 11 operating system

Hardening Windows 11 is crucial to enhance security and protect against cyber threats. This involves configuring settings, implementing robust authentication measures, updating regularly, employing firewall rules, restricting unnecessary services, and using security software. These practices safeguard your system and data from potential vulnerabilities and attacks.

Hardening Windows 11 involves several steps to enhance its security. Here’s a step-by-step guide:

Detail Procedures

Windows 11 clean and official installation sources

To perform a clean and official installation of Windows 11, you should follow the most current guidelines from Microsoft. Here are general steps:

1. Check System Requirements:

• Ensure your computer meets the minimum system requirements for Windows 11. These requirements may include a compatible processor, sufficient RAM, and TPM 2.0 support.

2. Backup Your Data:

• Back up all important data to an external drive or cloud storage to prevent data loss during installation.

3. Visit the Official Microsoft Website:

• Go to the official Microsoft website to access Windows 11 installation resources and download links.

4. Download Windows 11 Installation Media:

• On the official Microsoft website, look for a Windows 11 download tool or download link.
• Download the Windows 11 installation media creation tool or ISO file.

5. Create Installation Media:

• Run the Windows 11 installation media creation tool.
• Follow the on-screen instructions to create installation media. You can choose to create a bootable USB drive or download an ISO file.

6. Prepare the Bootable USB Drive (If applicable):

• If you chose to create a bootable USB drive, insert an empty USB drive (at least 8GB) into your computer.
• Follow the tool’s instructions to create the bootable USB drive.

7. Insert Installation Media:

• Insert the bootable USB drive or mount the Windows 11 ISO file (if you’re not using a USB drive) on the computer where you want to install Windows 11.

8. Boot from Installation Media:

• Restart the target computer.
• Access the BIOS/UEFI settings during startup (usually by pressing a key like F2, F12, or Del).
• Change the boot order to prioritize the USB drive or the device containing the ISO file.

9. Install Windows 11:

• Save the BIOS/UEFI changes and restart the computer.
• The computer will boot from the installation media.
• Follow the on-screen instructions to install Windows 11.
• During installation, you will need to choose your language, region, keyboard layout, and enter your product key if prompted.

10. Partition and Format Drives (If Needed):
– You can create partitions and format the drive during the installation process if needed.

11. Configure Settings:
– Follow the setup wizard to configure settings like user accounts, network, and privacy preferences.

12. Activate Windows 11:
– After installation, activate Windows 11 using a valid product key if it’s not automatically activated. Enter the key when prompted.

13. Install Drivers and Updates:
– After installation, install necessary device drivers and check for Windows updates to ensure your system is up to date and functioning correctly.

14. Install Applications and Restore Data:
– Install your preferred applications and restore your data from your backup.

15. Finalize Security Settings:
– Configure security settings such as Windows Defender, Windows Firewall, and user account security.

16. Regularly Update Windows:
– Enable automatic Windows updates to keep your system secure with the latest patches and improvements.

For the most accurate and up-to-date information on Windows 11 installation, refer to the official Microsoft website or consult Microsoft’s official documentation and guidelines.

Install Windows 11 Security Baseline

To install the Windows 11 Security Baseline, follow these steps:

1. Visit the official Microsoft Security Compliance Toolkit (SCT) website.
2. Download the “Windows 11 Security Baseline” from the provided link.
3. Extract the downloaded files and review the documentation for guidance on implementing the security recommendations.
4. Use Group Policy, PowerShell scripts, or other relevant tools to apply the security settings outlined in the baseline to your Windows 11 devices.
5. Test the applied security configurations to ensure they do not disrupt essential operations.
6. Continuously monitor and update your security settings as needed to adapt to evolving threats and compliance requirements.

By following these steps, you can enhance the security of your Windows 11 environment using the recommended baseline configurations provided by Microsoft.

Lock Account with Complex Password

To lock a user account with a complex password, you’ll typically follow these steps on a Windows system:

1. Log in as an Administrator: Ensure you have administrative privileges on the system.
2. Open Command Prompt or PowerShell: Right-click on the Start button and choose either “Command Prompt (Admin)” or “Windows PowerShell (Admin).”
3. Choose a User Account: Use the following command to lock a specific user account (replace Username with the actual username):

   net user Username /lock

4. Set a Complex Password: You can also enforce a complex password for the user. Use this command to change or set a new password (replace NewPassword with your desired complex password):

   net user Username NewPassword

5. Unlock the Account: If needed, you can unlock the account using the following command:

   net user Username /unlock

Remember to replace Username with the actual username of the account you want to lock or unlock, and NewPassword with the desired complex password.

Please exercise caution when performing these actions, especially on user accounts, as improper use can lock users out of their accounts, potentially causing access issues.

Use a Password Manager

Using a password manager is a crucial step in enhancing your online security. Here’s how to do it:

1. Choose a Password Manager: Select a reputable password manager such as LastPass, 1Password, Bitwarden, or Dashlane.
2. Install and Set Up: Download and install the password manager app or browser extension on your devices.
3. Create a Master Password: This is the only password you need to remember. Make it complex, unique, and memorable.
4. Store and Generate Passwords: Let the password manager generate and store complex, unique passwords for each of your online accounts.
5. Auto-Fill Credentials: The password manager will auto-fill your login credentials when you visit a website or app, saving you time.
6. Secure Notes: Use the password manager to securely store sensitive information, like credit card details or PINs.
7. Sync Across Devices: Ensure your password manager syncs passwords across all your devices for convenience and consistency.
8. Enable Two-Factor Authentication (2FA): Many password managers support 2FA for added security. Enable it wherever possible.
9. Regularly Update and Review: Periodically review your stored passwords, updating any weak or compromised ones.
10. Backup Your Password Manager: Backup your password manager’s data to prevent data loss.

Using a password manager significantly improves your online security by creating and managing complex, unique passwords for each of your accounts, reducing the risk of unauthorized access and data breaches.

Disable Automatic Login

Disabling automatic login on your computer adds an extra layer of security, ensuring that you have to enter your password or another form of authentication each time you start your computer. Here’s how to disable automatic login on Windows 11:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Accounts”: In the Settings window, select “Accounts.”
3. Select “Sign-in options”: Under Accounts, click on “Sign-in options” on the left pane.
4. Scroll Down to “Require sign-in”: In the right pane, scroll down to the “Require sign-in” section.
5. Choose an Option: There are several options to choose from:

• “Never” will disable automatic login entirely, requiring a password every time you start your computer.
• “When PC wakes up from sleep” will require a password after your computer wakes from sleep mode.
• “Every time” will require a password every time your computer is locked or wakes from sleep.

1. Make your Selection: Choose the option that best suits your security preferences.
2. Close Settings: Once you’ve made your selection, you can close the Settings window.

Now, your computer will no longer automatically log in, and you’ll need to enter your password or use another form of authentication each time you start or wake up your system. This helps protect your computer from unauthorized access.

Enable Windows Firewall

Enabling Windows Firewall helps protect your computer from unauthorized network access and potential security threats. Here’s how to enable it on Windows 11:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Privacy & Security”: In the Settings window, select “Privacy & Security.”
3. Select “Windows Security”: Under Privacy & Security, click on “Windows Security” on the left pane.
4. Click on “Firewall & network protection”: In the Windows Security window, click on “Firewall & network protection.”
5. Turn on Windows Defender Firewall:

• Under “Firewall & network protection,” you’ll see the option “Windows Defender Firewall.”
• Click on it, and you’ll see separate settings for private and public networks.
• Toggle the switch to turn on the firewall for both “Private network” and “Public network.”

1. Confirm Your Choice: A confirmation dialog may appear. Confirm that you want to enable the firewall.
2. Close Settings: Once you’ve enabled the Windows Defender Firewall, you can close the Windows Security window.

Now, Windows Firewall is active and will help protect your computer by monitoring and controlling incoming and outgoing network traffic. It adds an important layer of security to your Windows 11 system.

Remove unnecessary drivers

Removing unnecessary drivers from your Windows 11 computer can help improve system stability, free up disk space, and prevent potential driver conflicts. Here’s how to remove unnecessary drivers:

Note: Be cautious when removing drivers, as uninstalling essential drivers can cause hardware issues. Only remove drivers that are truly unnecessary or causing problems.

1. Identify Unnecessary Drivers: a. Press Win + X and select “Device Manager” to open the Device Manager. b. In Device Manager, expand categories to view installed drivers. Look for drivers with yellow triangles or those related to devices you no longer use or have uninstalled.
2. Uninstall Unnecessary Drivers: a. Right-click on the driver you want to remove and select “Uninstall device.” b. Confirm the uninstallation by clicking “Uninstall.”
3. Restart Your Computer: a. After removing the drivers, it’s a good practice to restart your computer to complete the process.
4. Use Driver Uninstaller Tools (Optional): a. For more advanced driver cleanup, you can use third-party driver uninstaller tools like Display Driver Uninstaller (DDU) for graphics drivers. These tools can help you thoroughly remove driver remnants.
5. Back Up Drivers (Optional): a. If you’re unsure about which drivers to remove, consider using a driver backup tool to save your current drivers before uninstalling. This way, you can restore them if needed.
6. Windows Update (Optional): a. Windows Update may automatically install drivers for your hardware. If you prefer to manage drivers manually, you can disable automatic driver updates: i. Go to “Settings” > “Privacy & Security” > “Windows Update.” ii. Click “Advanced options” and then “View update history.” iii. Click “Driver updates” and select the driver you want to prevent from reinstalling. Right-click and choose “Uninstall.”

Always exercise caution when removing drivers, and be certain that a driver is unnecessary before uninstalling it. Removing essential drivers can lead to hardware issues and require you to reinstall them later.

Disable Remote Desktop

To disable Remote Desktop on a Windows 11 computer, follow these steps:

1. Press Win + I: This opens the Windows Settings.
2. Click on “System”: In the Settings window, select “System.”
3. Select “Remote Desktop”: On the left pane, click on “Remote Desktop.”
4. Toggle Off “Remote Desktop”: Under Remote Desktop settings, you will see a toggle switch. Slide it to the “Off” position to disable Remote Desktop.
5. Confirm Your Choice: A confirmation dialog may appear. Confirm that you want to disable Remote Desktop.
6. Close Settings: Once you’ve disabled Remote Desktop, you can close the Windows Settings window.

This action will turn off the Remote Desktop feature on your Windows 11 computer, preventing remote connections. It’s a good security practice if you no longer require remote access to your computer or want to reduce potential security risks.

Uninstall Unnecessary Software

Cleaning up your computer by uninstalling unnecessary software can improve system performance and free up valuable storage space. Here’s how to uninstall software in Windows 11:

Open Settings:

• Press Win + I to open the Windows Settings.

Click on “Apps”:

• In the Settings window, select “Apps” from the list.

View Installed Apps:

• Under the “Apps & Features” section, you’ll see a list of all installed applications on your computer. This list may take a moment to populate.

Sort and Filter (Optional):

• You can sort the list by name, install date, or size by clicking on the respective column headers.
• Use the search bar to find a specific application if you have many installed.

Select the Software to Uninstall:

• Click on the application you want to uninstall. This will open a menu with more options.

Click on “Uninstall”:

• Click the “Uninstall” button that appears when you select the application.

Confirm Uninstallation:

• A confirmation dialog will appear. Click “Uninstall” again to confirm the removal of the software.

Follow the Uninstallation Wizard:

• The uninstallation process will vary depending on the software. Follow the on-screen prompts to complete the uninstallation.

Repeat for Other Software:

• Go back to the list of installed apps and repeat steps 5 to 8 for any other software you want to uninstall.

Restart Your Computer:

• Some applications may require a computer restart to complete the uninstallation process. If prompted, restart your computer.

It’s important to review the list of installed applications carefully and only uninstall software that you are sure you no longer need. Be cautious about removing system-critical or essential software, as it could affect the functionality of your computer.

Keep Windows Updated

Keeping Windows updated is essential for maintaining the security and performance of your computer. Here’s how to ensure Windows stays up to date on Windows 11:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Windows Update”: In the Settings window, select “Windows Update.”
3. Check for Updates: Click the “Check for updates” button. Windows will search for available updates.
4. Install Updates: If updates are found, click “Install” to start the update process. Your computer may need to restart to complete the installation.
5. Automatic Updates: To ensure ongoing updates, you can configure automatic updates:

• Under “Windows Update,” click “Advanced options.”
• Under “Pause updates,” make sure it’s set to “Off.”
• Under “Automatic update options,” ensure “Automatically download updates, even over metered data connections” is turned on.

Restart as Needed: Some updates may require a restart. Windows will prompt you to restart your computer when necessary.

Regularly updating Windows provides critical security patches, bug fixes, and performance improvements, helping to protect your system from vulnerabilities and ensuring it runs smoothly.

Enable Encryption

Enabling encryption on your Windows 11 computer is a crucial step to protect your data from unauthorized access in case your device is lost or stolen. Windows 11 includes BitLocker for this purpose. Here’s how to enable it:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Privacy & Security”: In the Settings window, select “Privacy & Security.”
3. Select “Device security”: On the left pane, click on “Device security.”
4. Under “Device encryption,” click “Learn more”: This will open the Windows Security app.
5. Check Encryption Status: In the Windows Security app, under “Device encryption,” check the status. If it’s already enabled, you’re all set. If not, click “Turn on” or “Set up” to begin the encryption process.
6. Follow the On-screen Instructions: You may be prompted to create or confirm a PIN or password, as this will be required to unlock your device after encryption.
7. Wait for Encryption to Complete: The encryption process may take some time, depending on the size of your hard drive and the speed of your computer.
8. Restart Your Computer: After the encryption process is complete, restart your computer to ensure that it boots securely.

Once encryption is enabled, your data is protected by BitLocker, and it can only be accessed with the correct encryption key (which is protected by your PIN or password). This adds a significant layer of security to your Windows 11 system.

Manage App Permissions

Managing app permissions in Windows 11 allows you to control what resources and information installed applications can access. Here’s how to do it:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Privacy & Security”: In the Settings window, select “Privacy & Security.”
3. Select “App permissions”: On the left pane, click on “App permissions.”
4. Choose a Permission Category: Under “App permissions,” you’ll see various categories such as Camera, Microphone, Location, etc. Click on the category for the permission you want to manage.
5. Manage Individual App Permissions:

• You will see a list of apps that have requested access to the selected resource.
• To grant or revoke permissions for a specific app, toggle the switch next to the app’s name.
• Some permissions may have advanced settings or additional options you can configure.

Configure Advanced Permissions:

• For some permissions, you can click on “Advanced app permissions” to access more detailed settings.
• Here, you can control which apps can access specific resources, even in the background.

Review and Adjust Other Permissions: Repeat the process for other permission categories as needed.

Close Settings: Once you’ve configured app permissions to your satisfaction, you can close the Windows Settings window.

By managing app permissions, you can enhance your privacy and security by ensuring that only trusted apps have access to your sensitive resources like your camera, microphone, or location data on your Windows 11 device.

Increase User Account Control (UAC) Settings

To increase User Account Control (UAC) settings in Windows 11, follow these steps:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Privacy & Security”: In the Settings window, select “Privacy & Security.”
3. Select “Windows Security”: On the left pane, click on “Windows Security.”
4. Click on “Virus & Threat Protection”: Under Windows Security, click on “Virus & Threat Protection.”
5. Manage Settings: Under Virus & Threat Protection Settings, click on “Manage settings” under the “Virus & Threat Protection Settings” section.
6. Toggle on “Controlled folder access”: Scroll down and find “Controlled folder access.” Turn this feature on if it’s not already enabled.
7. Configure Controlled Folder Access: Click on “Manage Controlled folder access” to configure which folders are protected. You can add or remove folders as needed.
8. Back to Windows Security: Close the Controlled Folder Access settings window and go back to the main Windows Security page.
9. Click on “App & Browser Control”: On the Windows Security page, click on “App & Browser Control.”
10. Configure SmartScreen Settings: Under “Check apps and files,” you can choose between “Warn” and “Block” for downloaded files. Select the level of protection you want.
11. Back to Windows Security: Close the App & Browser Control settings window and go back to the main Windows Security page.
12. Click on “Device Security”: On the Windows Security page, click on “Device Security.”
13. Security Processor Details: Click on “Security Processor Details” to access hardware security settings.
14. Configure Hardware-based Security: Depending on your hardware, you may have options to configure hardware-based security features. Follow the on-screen instructions to set these up.
15. Close Settings: Once you’ve configured the desired UAC settings and other security features, you can close the Windows Security settings window.

By increasing UAC settings and configuring additional security features, you enhance your Windows 11 system’s protection against malware, unauthorized access, and potential threats.

Enable Memory Integrity

Enabling Memory Integrity on Windows 11 provides an additional layer of security by protecting the integrity of your computer’s memory from various types of attacks. To enable Memory Integrity, follow these steps:

1. Press Win + I: This opens the Windows Settings.
2. Click on “Privacy & Security”: In the Settings window, select “Privacy & Security.”
3. Select “Device security”: On the left pane, click on “Device security.”
4. Under “Core isolation,” click “Core isolation details”: This will allow you to enable Memory Integrity.
5. Enable Memory Integrity: Toggle the switch next to “Memory Integrity” to turn it on.
6. Confirm Your Choice: A confirmation dialog may appear. Confirm that you want to enable Memory Integrity.
7. Restart Your Computer: After enabling Memory Integrity, you’ll need to restart your computer to apply the changes.

Once Memory Integrity is enabled, your system will be better protected against attacks that target vulnerabilities in the Windows kernel and memory. This feature uses hardware-based security mechanisms to ensure the integrity of your computer’s memory.

Close Listening Ports

To close listening ports on a Windows 11 computer, you’ll need to use the Windows Firewall to block or restrict access to specific ports. Here’s how to do it:

1. Press Win + S and search for “Windows Security.” Open the Windows Security app.
2. In the Windows Security app, click on “Firewall & network protection.”
3. Under “Firewall & network protection,” you will see two network profiles: “Private network” and “Public network.” These profiles correspond to different network types (e.g., your home network and public Wi-Fi).
4. Click on the network profile for which you want to close listening ports (e.g., “Private network” for your home network).
5. Under “Windows Defender Firewall,” click on “Advanced settings.” This opens the Windows Firewall with Advanced Security.
6. In the Windows Firewall with Advanced Security window, you’ll see “Inbound Rules” on the left pane. These rules control incoming traffic.
7. To block a specific port, right-click on “Inbound Rules” and choose “New Rule.”
8. In the “New Inbound Rule Wizard,” select “Port” and click “Next.”
9. Specify the port number or range you want to block, choose whether to block the connection or allow it (you likely want to block it), and click “Next.”
10. Choose the network type to which this rule applies (e.g., “Domain,” “Private,” or “Public”). Usually, you’d select “Domain” and “Private” for a home network, but choose according to your network setup. Click “Next.”
11. Provide a name and optional description for the rule. Click “Finish” to create the rule.

Repeat these steps for any other ports you want to close. Make sure you follow the same process for both “Private” and “Public” network profiles if needed.

Keep in mind that closing ports should be done with caution, as it can impact the functionality of applications or services that rely on these ports. Ensure you understand the implications before blocking any ports.

Browser Security

Ensuring browser security in Windows 11 is essential to protect your online privacy and prevent malware infections. Here are steps to enhance browser security in Windows 11, regardless of your choice of web browser:

Keep Your Browser Up to Date:

• Regularly update your web browser to the latest version to receive security patches and bug fixes.

Use a Secure and Reputable Browser:

• Choose a browser known for its security features and frequent updates, such as Google Chrome, Mozilla Firefox, Microsoft Edge, or Safari.

Enable Automatic Updates:

• Ensure that your browser is set to automatically update to the latest version to stay protected against known vulnerabilities.

Install Browser Extensions:

• Add security-focused browser extensions:
  • Ad Blockers: Block ads and potential sources of malware.
  • Privacy Extensions: Enhance privacy by blocking tracking cookies.
  • Password Managers: Securely store and generate complex passwords.
  • HTTPS Everywhere: Force websites to use secure HTTPS connections.

Use a Strong and Unique Password for Your Browser:

• Protect your browser with a strong password to prevent unauthorized access to your saved passwords and settings.

Enable Two-Factor Authentication (2FA):

• If your browser supports it, enable 2FA for an extra layer of security.

Be Cautious with Extensions:

• Only install browser extensions from trusted sources and review the permissions they request.

Regularly Review and Update Extensions:

• Keep extensions up to date to ensure they receive security updates.

Configure Privacy Settings:

• Customize your browser’s privacy settings to limit tracking and data collection.
• Use private or incognito browsing mode for sensitive tasks.

Disable or Remove Unused Extensions:

• Uninstall or disable extensions you no longer use to reduce the attack surface.

Set Strong Content and Security Policies:

• Some browsers allow you to configure content and security policies. Adjust them according to your preferences.

Clear Cookies and Cache:

• Regularly clear your browser’s cookies and cache to remove tracking data.

Use a Secure Search Engine:

• Choose a privacy-focused search engine like DuckDuckGo or Startpage to avoid tracking.

Be Wary of Phishing Attempts:

• Avoid clicking on suspicious links or downloading files from untrusted sources.

Educate Yourself on Safe Browsing Habits:

• Stay informed about common online threats and phishing tactics to recognize and avoid them.

Regularly Backup Your Bookmarks and Settings:

• Periodically back up your browser bookmarks, settings, and passwords to prevent data loss in case of issues or malware.

Monitor Browser Add-ons and Plug-ins:

• Keep third-party browser add-ons and plug-ins up to date or remove unnecessary ones.

By implementing these browser security practices, you can significantly enhance your online safety and protect your Windows 11 system from potential threats while browsing the web.

Network Security

Network security is crucial to protect your Windows 11 system and data from threats and unauthorized access. Here are steps to enhance network security:

Router Security:

• Change the default login credentials for your router.
• Enable WPA3 encryption for Wi-Fi.
• Change the default SSID (network name) to something unique.
• Disable remote management unless necessary.
• Regularly update your router’s firmware.

Firewall:

• Enable the built-in Windows Firewall or use a third-party firewall to control incoming and outgoing traffic.
• Configure firewall rules to allow only necessary traffic.

Antivirus and Antimalware:

• Install reputable antivirus and antimalware software.
• Keep the security software and virus definitions up to date.

Regular Updates:

• Ensure that Windows 11 is updated with the latest security patches.
• Keep third-party software, especially browsers and plugins, up to date.

Network Segmentation:

• Separate your network into different segments, such as guest and internal networks, using VLANs or network policies.

Strong Wi-Fi Security:

• Use a strong, unique Wi-Fi password with WPA3 encryption.
• Disable WPS (Wi-Fi Protected Setup) if not needed.

Network Monitoring:

• Use intrusion detection and prevention systems (IDS/IPS) to monitor network traffic for anomalies.

Password Security:

• Use strong, unique passwords for your router, Wi-Fi, and other network devices.
• Enable multi-factor authentication (MFA) whenever possible.

Guest Network:

• Set up a separate guest network for visitors to keep them isolated from your main network.

VPN (Virtual Private Network):

• Use a VPN service, especially when accessing public Wi-Fi networks or when working remotely.

Network Access Control (NAC):

• Implement NAC solutions to control and manage access to your network, especially in enterprise environments.

Regular Backups:

• Regularly back up important data to a secure location, including network-attached storage (NAS) devices or cloud storage.

Security Policies:

• Define and enforce network security policies for your organization or home network.

User Education:

• Educate users about phishing attacks, social engineering, and safe online behavior.

Device Security:

• Ensure that all devices connected to the network have updated security software and are configured securely.

Remote Access Security:

• If you need remote access to your network, use secure methods like VPNs and secure remote desktop protocols.

Monitoring and Logging:

• Set up network monitoring tools and log network activity for analysis and threat detection.

Incident Response Plan:

• Develop and regularly update an incident response plan to address security breaches and network incidents.

Vendor and Service Reviews:

• Regularly review and assess the security of third-party services and devices connected to your network.

Regular Security Audits:

• Conduct periodic security audits and vulnerability assessments to identify and mitigate network weaknesses.

By implementing these network security measures, you can significantly reduce the risk of security breaches and protect your Windows 11 system and data from threats.

See also

https://spca.education/category/spca-tutorials/

https://blogs.windows.com/windowsexperience/2021/06/24/introducing-windows-11/