Hardening Windows 11

[AJAshinoff]

Enviroment: Windows 2019 domain, Win 10 Pro workstations and role systems

Retiring hardware has prompted the lock-stock-and barrel replacement of a couple of systems. These new systems, role oriented, came with Windows 11 pre-loaded. I could wipe the pre-load an install win10 but that would be like putting my finger in the dike because it sprung a leak. The writing is on the wall and its inevitable.

I've scoured the web and came up with nothing helpful. I even, foolishly, asked Microsoft directly. Microsoft's reply, keep windows 11 patched and up to date.

There must be some way, even a modest way , to harden Windows 11, to be able to restricting what content is sent and received, where privacy is preserved, and their AI is reigned in.

And yes, I trust MS only slightly more than I trust a stranger when it comes to my responsibilities to my employer.

Any assistance/strategies are appreciated.

 

[geofelt]

If you can, disconnect physically from the internet and wifi.

 

[punkncat]

Perhaps something like 'Endpoint Protection' might be a workable solution. The only real trouble(s) I have run into over the recent years is occasionally Chrome (for instance) would have undesirable issues until an update/patch, typically a few days, but can be crippling in its own way.

 

[USAFRet]

Enviroment: Windows 2019 domain, Win 10 Pro workstations and role systems

Retiring hardware has prompted the lock-stock-and barrel replacement of a couple of systems. These new systems, role oriented, came with Windows 11 pre-loaded. I could wipe the pre-load an install win10 but that would be like putting my finger in the dike because it sprung a leak. The writing is on the wall and its inevitable.

I've scoured the web and came up with nothing helpful. I even, foolishly, asked Microsoft directly. Microsoft's reply, keep windows 11 patched and up to date.

There must be some way, even a modest way , to harden Windows 11, to be able to restricting what content is sent and received, where privacy is preserved, and their AI is reigned in.

And yes, I trust MS only slightly more than I trust a stranger when it comes to my responsibilities to my employer.

Any assistance/strategies are appreciated.

Specifically, what content and privacy are you concerned about?

Solutions, if any, may vary.

 

[AJAshinoff]

Specifically, what content and privacy are you concerned about?

Solutions, if any, may vary.

Restricting or removing tracking for targeted advertisement purposes or any other reason. The ability to restrict or deny edge AI to monitor and harvest whatever MS sees fit to know/take.

I have little trust toward MS or anyone other than what is on my campuses and HAVING to use the web as anything more than a tool, even from MS, is unsettling.

 

[AJAshinoff]

If you can, disconnect physically from the internet and wifi.

Well that's a certainty for sure but its hardly a solution for hardening. Proper IT philosphoy, probably old school these days, the network is a corporate necessity but the internet is a tool not the central point.

 

[AJAshinoff]

Perhaps something like 'Endpoint Protection' might be a workable solution. The only real trouble(s) I have run into over the recent years is occasionally Chrome (for instance) would have undesirable issues until an update/patch, typically a few days, but can be crippling in its own way.

Yes, I have an endpoint solution and it has helped. The trouble is 11 is a sieve and with endpoint established on and around that system it validates and opening for Microsoft, and because MS isn't bulletproof, others who hack MS products.