I am historically a Linux guy, and only use Windows when I absolutely have to via VM. However, I recently purchased a new rig so that I can keep a dedicated Windows 7 machine up for hard work (cough,gaming,cough) and for software which just won't run on Linux.

I'm more than a little nervous. I'm very skilled in hardening Linux systems, but I'm a fish out of water when it comes to Windows. I've installed Microsoft Security Essentials and have Windows Firewall enabled, but I still feel like that's not quite enough (I saw a few viruses get past Security Essentials before I switched my wife from Windows Vista to Linux. Granted, she probably helped them by...she's quick to click things).

What steps should a paranoid user take to make his Windows 7 setup as secure as possible, aside from cutting the network cable?

  • Run the 64bit version of W7, it is much more secure out of the box than its 32bit counterpart. – Moab May 7 '12 at 16:04
  • @Moab How is the 64-bit edition more secure than the 32-bit? – abstrask May 9 '12 at 7:44
  • Since Vista 64 bit uses KPP or Patchguard, secure in the sense of guarding against malware that tries to patch the kernel to get super root priveledges....en.wikipedia.org/wiki/Kernel_Patch_Protection – Moab May 9 '12 at 13:59

Set up Windows 7 with a normal user account beside the Administrator account, just as you'd do on Linux. It's virtually impossible to really screw up the entire PC with just a normal user account.

This way, any suspicious activity will require an Administrator password at the elevation prompt (sudo equivalent)

  • 2
    This simple step buys you a lot of protection. – LawrenceC May 7 '12 at 15:36
  • You can do this just by tweaking the UAC settings. – Ben Voigt May 7 '12 at 16:05
  • Renaming the administrator & guest accounts is also possible. Run "secpol.msc", then navigate to Security Settings->Local Policies->Accounts: Rename administrator account/Rename guest account. Plus, these a plethora of other security settings this dialog provides for your hardening pleasure! – Chad Harrison May 7 '12 at 20:04
  • Standard user FTW. – surfasb May 7 '12 at 23:50

I think that, given you're coming from an environment that requires you to understand what's going on, you'll have no problem keeping things secure on Windows. In my experience, most issues arise from inexperienced or lazy users shooting themselves (and their systems) in the foot. Windows gives you a reasonable level of security, but of course doesn't prevent you (the user) from weakening it. The following list is fairly basic common-sense, but IMHO is where most of the problems arise:

  1. Take notice of the UAC prompts - even if your user has admin privileges, Windows will still require your confirmation for anything that needs elevation. Pay attention to what you're authorizing.
  2. Make sure you allow Windows to stay on top of updates.
  3. Don't install software you don't trust - especially stay away from shadyware like keygens, game cracks, etc.
  4. Understand how the firewall works - if you've been using iptables then this will be an order of magnitude simpler. Use the Windows Advanced Firewall screen to check and manage what's exposed.
  5. It should go without saying, don't click on that Viagra ad!
  • 4
    And turn UAC all the way up. Vista was better about this, the default setting in Windows 7 allows various injection attacks against Microsoft-signed executables to run arbitrary code elevated without prompt. – Ben Voigt May 7 '12 at 16:04

This is not hardening per se, but you can run Microsoft Baseline Security Analyzer to check for potential security problems.

  1. Beside Windows Security Essentials and Firewall I would also install EMET (The Enhanced Mitigation Experience Toolkit from Microsoft) don't forget to read the EMET user guide.
  2. Always use Standard User Account as your default account. Turn UAC settings all the way up.
  3. If you are downloading much from the internet install the free version of MalwareBytes and let it scan sometimes your PC.
  4. Download a good Task Manager like Process Hacker or Process Explorer, because the built in one in Windows 7 is not that good (Windows 8 built in one is much better). But you can use Resource Monitor (type in search resmon.exe) which is good.
  5. Use 64 bit version of Windows 7/8
  6. If you have downloaded Java disable Java in the Browser from the Java Control Panel
  7. Download tools from Nirsoft or Sysinternals like TcpView, might help you if you catch some malware.
  8. Turn on Data Execution Prevention for all programs.
  9. I would use Chrome because it is secure by design and I think it is more secure than other browsers (Just my opinion).
  10. Change Advance Sharing Settings, turn off network discovery.
  11. Install always the latest Windows Updates
  12. I personally would Upgrade to Windows 8.1, which is more secure than Windows 7

You can go even further but normally you just need to do 2,3 and 11. And because you are a experienced user you will be safe.


If a Windows machine is being used as a web client, a good idea is to use Firefox with the NoScript add-on. (And of course Adblock Plus; that goes without saying.)

If you accidentally navigate into a site with malicious scripts, NoScript will save your ass.

NoScript can be obtrusive, and requires user education. (If the user just blindly says yes to all scripts, it is pointless.)

Install Evince for reading PDF's; stay away from Adobe. (There is a way to get Evince to show embedded in Firefox: http://www.libertexto.org/libertexto_en.html .)

Do not use Windows Media Player; install an alternative. Windows Media Player allows media files to prompt the user to download things. "You need a special codec to play this video. Click to install FOO.EXE."

Train your users not to download and open any untrusted attachments received over e-mail and never to say yes to any unexpected dialog box.

  • A note about NoScript, with a caveat that it was a long time ago (FireFox 1.5, anyone?) and I may have been the only one to experience it. I had a few pages where even though I'd whitelisted everything I could find it continued to operate and disable some scripts on the page (I'm guessing they had different-server based scripts or some such) - and this managed to continue even after I'd uninstalled the add on. I think it left some claws in some strange places and never quite removed them. So just be aware of that. – Margaret May 23 '12 at 8:57

I would like to add/update a few points:

Get a good security software(its necessary on windows). MSE is not enough. You can look up the internet for free/paid ones. I cant recommend one here.

Though a little extreme, one more idea is to install windows on a drive and softwares on others. Keep documents/data on non-windows drive Configure windows/softwares and then "Freeze" the windows partition using something like faronics deepfreeze.

This will definitely protect you from all kinds of malware by preventing any lasting changes to windows files or settings. Just a restart is enough to get rid of all malware and their impact on system. The antivirus software will take of malware on non-windows drive.


There are several ways you can harden a Windows system, The first is to remove/disable any services that you do not or will not use. i.e. remote services or telnet. Next you want to disable/rename your built in accounts. You want to have and admin account but that shouldn't be the account you would be logging into on a daily basis you want to create a user account for yourself and that should be the one you are utilizing. I know it is aggravating but if malware is downloaded it would only be able to run at the level you are currently logged in at. Keeping your system update and with a good AV is very important. Lastly if you go by a STIG from either DISA, or FISMA, or NIST, it will give you a good baseline for your build. Some of those websites are in the box https://web.nvd.nist.gov/view/ncp/repository or http://iase.disa.mil/stigs/Pages/index.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.