Open-source tool to enforce privacy/security best-practices on Windows, macOS

Re:Open-source tool to enforce privacy/security best-practic... by encryptluks2 on Friday August 12, 2022 @09:20AM (#32438175)

I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Security Compliance Toolkit and re-imported to other machines. Another option is PowerShell Desired State Configuration which you can then use to backup your local GPO into a MOF file, and reapplied to multiple machines or even added as part of an unattended setup:

https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/...

I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by layer8 on Friday August 12, 2022 @09:29AM (#32438327)

Can you explain how policies are better? They generally just cause registry entries to be written, don’t they?

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by encryptluks2 on Friday August 12, 2022 @09:38AM (#32438439)

They are not just written to the registry but stored in a .pol file, and not all policies are easily managed via the registry. There are hundreds of policies that impact security and privacy. With policies you can easily print a report of what is changed with descriptions, and see deprecated policies or misconfigured ones. I'd recommend anyone to try it out and see the difference for themselves as to why it is much easier to manage these using local group policies vs a bunch of registry entries.

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by themenomen on Friday August 12, 2022 @10:00AM (#32438775)

Aren't many of those only available in pro/enterprise versions of Windows?

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by encryptluks2 on Friday August 12, 2022 @10:32AM (#32439265)

Yes and no... The gpedit.msc isn't included by default in Windows Home Edition, but it can easily be added:

https://windowsreport.com/enable-gpedit-windows-11/

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by Tijdreiziger on Friday August 12, 2022 @10:28AM (#32439214)

Do you have any suggestions for privacy-enhancing GPOs?

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by encryptluks2 on Friday August 12, 2022 @10:52AM (#32439523)

There are too many to really point out any in particular. Here is an LGPO text file for my machine policies. These can be converted to a Policy Analyzer .PolicyRules file using LGPO.exe I believe to get more input as to what they are used for. You also have to add those policy templates (ADMX), which I have a few added for Zoom, Chrome, Firefox, LibreOffice, Office, Edge, etc.

https://dpaste.com/ARRBCVVXN

[ Parent | on HN ]

Re:Open-source tool to enforce privacy/security best-practic... by Tijdreiziger on Friday August 12, 2022 @10:59AM (#32439621)

Thanks!

[ Parent | on HN ]