Windows 11 General Discussion

[Klemc]

I don't really unserstand all this securitys's stuff, is it all tied to connected computers ?

 

[ThrashZone]

I don't really unserstand all this securitys's stuff, is it all tied to connected computers ?

Hi,
Don't feel like the lone ranger bud
Not sure ms does either hehe

Reflect is replacing C as we speak on a clean install I'm doing on z490 rig
After hopefully just startup repair should sort the booting issue.

Then it will be down to redirecting RE or recreating it.
Not sure this latest update in on the 23h2 rufus downloaded today hope it's not so I can see now if the new RE works doing updates after.

 

[Jetster]

Is there a way to disable the pin/password? I have a four-letter password on both on my computers. Laptop uses a fingerprint (and the same password too)

You can make the pin use letter and well and numbers. Just open up "Change Pins" check box to use letters. That's about as far as I got

 

[ThrashZone]

Can't beat that logic
Make a pin into a password so you have a password and a pin and another password two being the same

 

[lexluthermiester]

Statement was comparative. Nowhere does it make claims on how secure Windows is or is not on the whole. Whether correct is more than I can say.

To be fair, Windows 11 is securable. It just takes a lot of tweaking which involves removing many of microsoft's included apps and crap.

 

[ThrashZone]

Hi,
Well good news is I got the new RE to work in front of C
Bad I used refresh install keeping apps and files to do it

I was due for a refresh the mbr was pretty old and I did get the original C partition transferred so that's a large plus
Only some cleanup to do
Got these files off my laptop and ready if refresh went weird lol

 

[gurusmi]

To be fair, Windows 11 is securable. It just takes a lot of tweaking which involves removing many of microsoft's included apps and crap.

To be honest. Win wont ever be that hardened compared to other OS'ses. Therefor it is used much to much. To say it clear. If hackers compromise Win they do compromise much more users than hacking other os'ses.

 

[lexluthermiester]

Win wont ever be that hardened compared to other OS'ses.

That is not true, you just have to know what you're doing and how to plug up all the holes left open by microsoft. For someone who knows what they're doing, Windows can be as secure as Linux, Unix or BSD. And while I know that is a bold statement, I have tested this with a group of white hats that enjoy hacking the crap out of security setups.

IF you can get past MY Windows security configurations, you're freaky-ass good!

 

[ThrashZone]

Hi,
Yeah besides windows firewall I feel best just with mbam pro in the background than pretender oops I mean defender hehe
But cut down on all the new security holes with newly named gadgets platform plus all the home calling ms apps and modern windows is just a security breach away from happening
I've known people that used nothing but pretender only to be jacked by ransomware
Installed a good av and not happened again and they are still dumb it's just the third party av isn't lol

 

[gurusmi]

That is not true, you just have to know what you're doing and how to plug up all the holes left open by microsoft. For someone who knows what they're doing, Windows can be as secure as Linux, Unix or BSD. And while I know that is a bold statement, I have tested this with a group of white hats that enjoy hacking the crap out of security setups.

IF you can get past MY Windows security configurations, you're freaky-ass good!

As a project manager süecialized on Software rollouts you can believe me that windows never have been the final thought about security and it will never be. Aside the typical problems one always need different os'ses to harden windows a bit. The biggest problem of win is that there are much to much hackers against on the front. They find holes you never thought about. No matter which AV ad firewall. A simple USB Stick with linux on it is enought to take over control at a windows os and delete the password of an administrator.

The first way to get safe is to remember this every second win is running.

 

[lexluthermiester]

windows never have been the final thought about security and it will never be.

Didn't say it was.

The biggest problem of win is that there are much to much hackers against on the front.

That IS a big problem, no doubt there.

They find holes you never thought about.

I've been at this for several decades. There is very little that I've never thought about..

No matter which AV ad firewall.

Sorry, but that just isn't true, especially if you use more than one in a tiered and layered method.

A simple USB Stick with linux on it is enought to take over control at a windows os and delete the password of an administrator.

Assuming you have that kind of access AND that security features which prevent a casual, unauthenticated boot-up are not in place...

The first way to get safe is to remember this every second win is running.

Knowledge is power. Knowing your foundations and the methodologies of your potential opponents is key to locking down open holes to system security.

Now please understand, I'm not saying my network/systems are unhackable, only that doing so is difficult enough that unless you have a very good reason to want data stored on my systems AND you're a hacker with phuking freaky skills, you're not getting in. And data on my encrypted drives? Forget about it. That data IS uncrackable, end of story.

Done right, Windows CAN be secured, or maybe I should say secured enough.

 

[InVasMani]

Is there a way to disable the pin/password? I have a four-letter password on both on my computers. Laptop uses a fingerprint (and the same password too)

It can be disabled I think its in in the windows settings menu in the account section and then under sign-in options portion of that has stuff related to the pin. Understandable why people would prefer to leave it disabled it's a pain to type in a pin constantly.

 

[gurusmi]

Didn't say it was.

That IS a big problem, no doubt there.

I've been at this for several decades. There is very little that I've never thought about..

Sorry, but that just isn't true, especially if you use more than one in a tiered and layered method.

Assuming you have that kind of access AND that security features which prevent a casual, unauthenticated boot-up are not in place...

Knowledge is power. Knowing your foundations and the methodologies of your potential opponents is key to locking down open holes to system security.

Now please understand, I'm not saying my network/systems are unhackable, only that doing so is difficult enough that unless you have a very good reason to want data stored on my systems AND you're hacker with phuking freaky skills, you're not getting in. And data on my encrypted drives? Forget about it. That data IS uncrackable, end of story.

Done right, Windows CAN be secured, or maybe I should say secured enough.

The only computer that is safe is one that have nerver switched on and never will be.

I just realized that you are writing about private computers at a gamers home. I'm more talking about a business environment. My computers have to earn money. They aren't built for leisure. To be honest. In a professional envirnment a Windows PC is one of the biggest security problems. Your encrypted drive is not worth a dime if you get compromised by a software that encrypt your drive again. A lot of companies had to realize that. Guess why Daimler the mother of Mercedes Benz and a lot of other firms don't drive their systems on pure Windows. They also uses Solaris, HPUX,... to be a bit more safe. One single add of an EMail or link inside can compromise a whole network. No matter which or how much AV's or firewall's one uses. A lot of companies will certify that fact. You should take a look onto the german IT Security department (BSI). They suggest even for small businesses and home users to use i.e. Linux to have a more secure system. If most users tend to use Linux then the hackers in general will focus on Linux either. If you don realize that you are still a small amateur.

 

[ThrashZone]

Hi,
Okay this new and pretty wild
Just got a message on startup, Your password has expired and has to be changed lol
I entered the same and it went past and logged me in

Seems this is a new MS policy default, hell this install on my laptop is barely 45+- days old and to change it
With the refresh on z490 yesterday I'll have to do it to damn it's tough to make this silly crap up ms pulls
Keeping in mind I only use local accounts never a ms account and get this nonsense
Guess we can expect this with limited setup installing without internet
Source

Tired of the Your password has expired and must be changed prompts? Here is how to stop them.

Password expiration policies do not add security and should not be used. This article describes how to make Windows stop asking to change password.

www.winability.com

right-click on the Start button, choose Computer Management from the menu,
and navigate to System Tools - Local Users and Groups - Users:
Double click your user name, and change the password settings as follows:

User must change password at next logon: Off

Password never expires: On

z490 system was okay lol

 

[lexluthermiester]

The only computer that is safe is one that have nerver switched on and never will be.

On that point we can agree.

I just realized that you are writing about private computers at a gamers home. I'm more talking about a business environment. My computers have to earn money. They aren't built for leisure. To be honest. In a professional envirnment a Windows PC is one of the biggest security problems.

Generally speaking, yes. However, many of the methods I use can and are applied to workstations, servers and big iron mainframes, just in different ways. Here's a key point about Windows enterprise/server versions, they are are comparatively VERY lean & clean and thus MUCH easier to make "secure".

Your encrypted drive is not worth a dime if you get compromised by a software that encrypt your drive again.

You're talking about malware/ransomware that hijacks the target system. It's got to get in first. Properly trained users can never be used for "social engineering" exploits and a hardened firewall will never let anything like that kind of thing in to begin with.

A lot of companies had to realize that. Guess why Daimler the mother of Mercedes Benz and a lot of other firms don't drive their systems on pure Windows.

It would have been perfectly ok to do so if their admins and users had been properly trained, used proper methodologies and used proper tools. They, and everyone ELSE who's been hacked and compromised, didn't either because they knew what they COULD do and didn't or because they were ignorant to proper security and secure computing methodologies.

No matter which or how much AV's or firewall's one uses. A lot of companies will certify that fact.

Moose muffins! Proper tools, used in the proper way with a proper computing ethic will ALWAYS be effective. Windows is not the root problem, the people that misuse it are.

 

[ThrashZone]

Hi,
I love dual bios lol
Asus locked PTT = tpm on newest bios so it can't be disable, well you can but the setting doesn't stick

Didn't know how newest intel ME would work "yeah I updated it to" with older bios so switched bios and refreshed the version, it had a lot of profiles that weren't needed anymore.

Anyway now it's disabled and cmd throws error device not ready message
tpmtool getdeviceinformation

 

[lexluthermiester]

Asus locked PTT = tpm on newest bios so it can't be disable, well you can but the setting doesn't stick

It can if you unplug the module.

 

[ThrashZone]

It can if you unplug the module.

Hi,
As long as I can disable it I'm happy

The expiring password I posted about that happened on my laptop the other day might of happened because of rufus creating a user account feature I used.

 

[lexluthermiester]

Hi,
As long as I can disable it I'm happy

The expiring password I posted about that happened on my laptop the other day might of happened because of rufus creating a user account feature I used.

Have you gone into the UEFI and deleted the stored keys? Or just set Rufus not to create a user account.

 

[ThrashZone]

Have you gone into the UEFI and deleted the stored keys? Or just set Rufus not to create a user account.

Hi,
Well bitlocker never activated but either way I flashed bios 1 and refreshed bios 2 so I'm pretty sure that wipes the tpm on both

On my laptop I used all rufus features which is bitlocker off/.... I kind of like it so as long as I know what it does I don't mind turning off the expiring password deal
It was just a surprise it might be in rufus notes that I didn't read.

I used the same rufus settings for my z490 rig as a clean install so it would setup for gpt/ efi the password expiring setting wasn't changed because I used reflect winpe recovery media to drop my original C partition off a system image onto the new installs C which replaces the original hehe
This is a neat feature I just found out about also found out you can rearrange partitions as well

 

[Shrek]

I seem to recall that OS teams alternate, with the Windows 10 team now working on Windows 12; any truth in this?

 

[R-T-B]

A pin is more secure then a password. Windows doesn't link local passwords to TPM, therefore PINs are considered more secure than local passwords

TPM isn't really a security boost to that degree.

A simple USB Stick with linux on it is enought to take over control at a windows os and delete the password of an administrator.

yeah, you can do that with like any OS. Local access and unauthenticated boot rights mean you've lost.

 

[ThrashZone]

Hi,
This smells bad lol

Reminder: Changes to Windows Boot Manager revocations for Secure Boot effective April 9, 2024

Windows Message Center: Windows updates released July 11, 2023 and later include security measures which protect against a Secure Boot bypass vulnerability disclosed in CVE-2023-24932. Secure Boot is a Windows security feature designed to protect devices from bootkit malware. Administrators...

www.elevenforum.com

The MS grip is tightening hehe

CAUTION Once the mitigation for this issue is enabled on a device, meaning the revocations have been applied, it cannot be reverted if you continue to use Secure Boot on that device. Even reformatting of the disk will not remove the revocations if they have already been applied. Please be aware of all the possible implications and test thoroughly before applying the revocations that are outlined in this article to your device.

 

[R-T-B]

Hi,
This smells bad lol

Reminder: Changes to Windows Boot Manager revocations for Secure Boot effective April 9, 2024

Windows Message Center: Windows updates released July 11, 2023 and later include security measures which protect against a Secure Boot bypass vulnerability disclosed in CVE-2023-24932. Secure Boot is a Windows security feature designed to protect devices from bootkit malware. Administrators...

www.elevenforum.com

The MS grip is tightening hehe

Why on earth would you want to run code signed with a compromised certificate?

If you really do, just clear your bios secure boot certs. I'm honestly amazed people are still scared of secure boot after all the years it's existed... it's clearly not an MS takeover plot.

 

[lexluthermiester]

I seem to recall that OS teams alternate, with the Windows 10 team now working on Windows 12; any truth in this?

Nothing confirmed. Hell, microsoft hasn't even talked about Windows 12. It is literal speculation at this point. It doesn't matter how many other people talk about it, until microsoft themselves do so, it's nothing-sauce. Also, I think it's unlikely for several reasons, the primary being the Windows 11 LTSC roadmap. Just doesn't jive.

I'm honestly amazed people are still scared of secure boot after all the years it's existed... it's clearly not an MS takeover plot.

It is not fear. It's an annoyance, sometimes a difficult PITA and a needless one. We're not worried about microsoft shenanigans, it's more about practical usability and reasonable troubleshooting or servicing access. There are better ways to do things and better ways to secure things. SecureBoot is a poorly implemented waste of time & effort and isn't worthy of either.