Rock-solid hardening of a Windows 7 system?

Question

I am historically a Linux guy, and only use Windows when I absolutely have to via VM. However, I recently purchased a new rig so that I can keep a dedicated Windows 7 machine up for hard work (cough,gaming,cough) and for software which just won't run on Linux.

I'm more than a little nervous. I'm very skilled in hardening Linux systems, but I'm a fish out of water when it comes to Windows. I've installed Microsoft Security Essentials and have Windows Firewall enabled, but I still feel like that's not quite enough (I saw a few viruses get past Security Essentials before I switched my wife from Windows Vista to Linux. Granted, she probably helped them by...she's quick to click things).

What steps should a paranoid user take to make his Windows 7 setup as secure as possible, aside from cutting the network cable?

Answer 1

Set up Windows 7 with a normal user account beside the Administrator account, just as you'd do on Linux. It's virtually impossible to really screw up the entire PC with just a normal user account.

This way, any suspicious activity will require an Administrator password at the elevation prompt (sudo equivalent)

Answer 2

I think that, given you're coming from an environment that requires you to understand what's going on, you'll have no problem keeping things secure on Windows. In my experience, most issues arise from inexperienced or lazy users shooting themselves (and their systems) in the foot. Windows gives you a reasonable level of security, but of course doesn't prevent you (the user) from weakening it. The following list is fairly basic common-sense, but IMHO is where most of the problems arise:

1. Take notice of the UAC prompts - even if your user has admin privileges, Windows will still require your confirmation for anything that needs elevation. Pay attention to what you're authorizing.
2. Make sure you allow Windows to stay on top of updates.
3. Don't install software you don't trust - especially stay away from shadyware like keygens, game cracks, etc.
4. Understand how the firewall works - if you've been using iptables then this will be an order of magnitude simpler. Use the Windows Advanced Firewall screen to check and manage what's exposed.
5. It should go without saying, don't click on that Viagra ad!

Answer 3

This is not hardening per se, but you can run Microsoft Baseline Security Analyzer to check for potential security problems.

Answer 4

If a Windows machine is being used as a web client, a good idea is to use Firefox with the NoScript add-on. (And of course Adblock Plus; that goes without saying.)

If you accidentally navigate into a site with malicious scripts, NoScript will save your ass.

NoScript can be obtrusive, and requires user education. (If the user just blindly says yes to all scripts, it is pointless.)

Install Evince for reading PDF's; stay away from Adobe. (There is a way to get Evince to show embedded in Firefox: http://www.libertexto.org/libertexto_en.html .)

Do not use Windows Media Player; install an alternative. Windows Media Player allows media files to prompt the user to download things. "You need a special codec to play this video. Click to install FOO.EXE."

Train your users not to download and open any untrusted attachments received over e-mail and never to say yes to any unexpected dialog box.

Answer 5

I would like to add/update a few points:

Get a good security software(its necessary on windows). MSE is not enough. You can look up the internet for free/paid ones. I cant recommend one here.

Though a little extreme, one more idea is to install windows on a drive and softwares on others. Keep documents/data on non-windows drive Configure windows/softwares and then "Freeze" the windows partition using something like faronics deepfreeze.

This will definitely protect you from all kinds of malware by preventing any lasting changes to windows files or settings. Just a restart is enough to get rid of all malware and their impact on system. The antivirus software will take of malware on non-windows drive.