Hardening Windows — How to Secure and Protect Windows

I've learned a lot from this page (and not only about security but some of the features of Windows also)

https://www.hardenwindows10forsecurity.com/

When I forget how to find the page, I search for hardening windows 10, and then its the page with the bright orange background (clever idea that) which makes it stand out, and its usually in the top few results (it was about #5 for me this time)

I havent done everything on it as its massively long. 

I didn't buy his scripts but did it manually.

The main features are (trying to remember as it was a while ago):

Make a user account with only normal priveleges and not administrator ones, and use that account for your daily use. Only use the admin account when you are doing a lot of admin tasks on the OS.

Set up the Windows Defender Firewall to work in outgoing mode also. By default, the firewall only looks at incoming traffic to your PC but ignores everything outgoing from your PC to the internet. If you enable the outgoing mode, then only apps which are specifically on the whitelist of allowed apps can talk to the internet at all. This is really good for security, since it means if you end up with a malicious script somehow, the script wont be able to access the internet (unless its somehow writing itself over an exe that is already on your whitelist).

If your Windows OS is advanced enough (I think the cheapest "home" one does not have this feature unf) , you can set up a Software Restriction Policy . this will only allow programs in specifically allowed directories to run at all (!!) . you have to be somewhat careful setting this up as it would be possible to lock yourself out of being able to do anything , even to run the config for this, to undo it. But it is an amazing feature if you can be bothered as it means that only programs in allowed folder (e.g. program files) can run at all.

Both the 2 above features (Esp the 2nd) do make it more of a hassle to install new apps though. some apps are worse than others dep on how they are configured to install. ones that install to your user folder (like in "appdata") are usually more of a hassle, esp with the Software Restriction Policy, as you then have to allow that folder specifically.

e.g. if you have an outgoing firewall, then you have to find the location of the .exe and allow it in the list in the firewall control panel before it can access the net at all. 

Also some apps are annoying , like i have a FB desktop app that changes its location every time it updates , so  i have to go into the firewall settings and update that.

also, I've disabled v many of the services and other things he says to in the orange web page, though not all of them

 apart from the security advantage , a lot of it is also just a good exercise in learning Windows Admin skills