[SOLVED] How to Prepare Laptop (To Protect MY Privacy) for Use By Others

[MarsColonist]

I have a laptop computer I want to let someone else use for several days, but I have used it for looking up things on the internet that I'd rather this person not know about (I'm sure you guys can imagine what I'm referring to here without me stating it explicitly).

So I'm wondering how I can let them use the laptop in a way that doesn't let them know what I have looked up online, searched for, webpages I've visited, etc. I'm concerned because iirc either search engines or windows does all kinds of things like search suggestions, search history, browsing history, and probably some other things I'm not even aware of that might allow this person to intrude on my privacy if I allow them to use this other computer.

Typically I browse with Firefox. If I make a new Windows user account, will that browser and all my bookmarks, browsing history, etc show up in the Firefox that runs on the NEW and separate user account from mine? And if so and I delete it under the new user account, I won't also lose the Firefox installation on MY user account on that PC, will I?

To make matters worse, I have the impression this person is the nosy sort... so the probability they might actively seek ways to invade my privacy while they're using this other PC seems considerable.

I suppose the #1 step is to make a new user account for them in Windows without administrator privileges and either get rid of the browsers I use that might also be on that account or at least clear their browsing history, passwords, account data, etc, but there is probably more I should do other than just that, right? Or is that enough by itself?

The laptop is running Windows 10.

 

[USAFRet]

1. Create a full drive backup Image of how it is now. Macrium Reflect or similar
2. Create a new Standard user accout, for this person to use.

 

[USAFRet]

If you have your passwords and whatnot 'saved' in your browser, undo that.

Given physical access by your friend, many things are discoverable.

 

[BFG-9000]

It depends on a couple things... like do you have a spare hard disk (perhaps from an SSD upgrade), for example. And how difficult is it to get the disk out of your laptop?

If they need to use Windows, clone your drive, create a guest account and then delete your account (if you are paranoid you can then run cipher /w: or sdelete to zero-fill the free space). It pretty much does not matter what they do with it then, as you will be overwriting the disk afterwards.

If not or you are feeling less charitable, then you could take the disk out and give them a linux distro on USB or DVD to boot to. If they don't need anything but a browser, then even a kiosk distro (only shell is a browser, and disk is read-only as it only runs from RAM). It would be a gentle suggestion that maybe they should have their own laptop.

 

[SyCoREAPER]

It depends on a couple things... like do you have a spare hard disk (perhaps from an SSD upgrade), for example. And how difficult is it to get the disk out of your laptop?

If they need to use Windows, clone your drive, create a guest account and then delete your account (if you are paranoid you can then run cipher /w: or sdelete to zero-fill the free space). It pretty much does not matter what they do with it then, as you will be overwriting the disk afterwards.

If not or you are feeling less charitable, then you could take the disk out and give them a linux distro on USB or DVD to boot to. If they don't need anything but a browser, then even a kiosk distro (only shell is a browser, and disk is read-only as it only runs from RAM). It would be a gentle suggestion that maybe they should have their own laptop.

That is inadvisable. If they then sign in with their account as the sole Windows account the license could get transfered.

OP should just clone their drive, lock down their account tightly and delete everything and give the other person a standard or even lower level account.

 

[MarsColonist]

I should clarify... I will be "around" while they are using it. Not watching them closely, but in the area. Maybe even in the same room. So what they are able to do to violate my privacy is limited by that.

But I also don't want to feel like I have to watch them closely while they're using it. I'd like to feel free to focus on other things without worrying they might see something on my PC that they shouldn't.

 

[hotaru.hino]

You could try enabling the Guest account: https://www.isunshare.com/windows-10/4-ways-to-enable-and-disable-built-in-guest-on-windows-10.html

Otherwise have a standard user account they can log into. That alone blocks them from doing things like installing/uninstalling applications (most of them anyway, Electron/Chrome based apps install to the user account) or poking around in another user's folder. Any internet browsing history or whatever is stored in your user account, so they can't access it. I'm also certain even if they log into a Microsoft account, that doesn't change the user account type, so it'll still be a Standard user account.

There's also the workaround that you can add the new Standard User account to the Guest group, remove the others, and that'll effectively make it a guest account.

 

[Deleted member 14196]

Image the system to at least two external drives and make sure it’s verified. Then use a Windows, USB and format and reinstall clean. Then create your standard user and disable the guest account and do the group assignment as described above. That way your stuff is never on it in the first place.

when you get the machine back, simply restore your image

 

[MarsColonist]

You could try enabling the Guest account: https://www.isunshare.com/windows-10/4-ways-to-enable-and-disable-built-in-guest-on-windows-10.html

Otherwise have a standard user account they can log into. That alone blocks them from doing things like installing/uninstalling applications (most of them anyway, Electron/Chrome based apps install to the user account) or poking around in another user's folder. Any internet browsing history or whatever is stored in your user account, so they can't access it. I'm also certain even if they log into a Microsoft account, that doesn't change the user account type, so it'll still be a Standard user account.

There's also the workaround that you can add the new Standard User account to the Guest group, remove the others, and that'll effectively make it a guest account.

I guess making the standard user account is my best option given I'll be providing limited supervision and you say simply creating the new standard user account without admin privileges will stop them from looking at any browsing history, bookmarks, etc from my personal user account.

Many other suggestions sound like they'd be great if I wanted to do more work to set it up and wasn't going to be able to provide limited supervision. My apologies to those who made such suggestions... for the fact that I didn't make clear in my OP that I was going to be providing limited supervision, and thus, I assume, many of these extraordinary measures presumably shouldn't be necessary.

 

[hotaru.hino]

I guess making the standard user account is my best option given I'll be providing limited supervision and you say simply creating the new standard user account without admin privileges will stop them from looking at any browsing history, bookmarks, etc from my personal user account.

Many other suggestions sound like they'd be great if I wanted to do more work to set it up and wasn't going to be able to provide limited supervision. My apologies to those who made such suggestions... for the fact that I didn't make clear in my OP that I was going to be providing limited supervision, and thus, I assume, many of these extraordinary measures presumably shouldn't be necessary.

Also if you want to dig in deeper, like you have another accessible drive or something, you can set permissions on the account such that they also can't access it.

Basically, whatever you don't want the other account to access, right click on the folder -> Select "Properties" -> Go to the Security tab -> select the user account or group you want to modify (you may need to add it if it doesn't show up on the list) -> then set "Deny" on the permissions