Securing a Windows Computer

Issue / Question

Instructions on navigating how to secure a new Windows computer for security purposes.

What do I enable on a new Windows computer?
How do I set up a Windows computer?

Environment

Platform
- Windows
Audience Affected
- Staff

Resolution

Note: For best viewing on portable devices, please rotate the device to view in a landscape format.

Part of our mission is to protect the confidentiality, preserve the integrity, and promote data availability for authorized use. The following are recommendations for the least restrictive way to secure the Windows Operating System.

Authorized Operating Systems
- Only Windows Enterprise is authorized for use on ISU-owned equipment.
Permanently Disable
- Wi-FI Sense - This has been deprecated in the later versions of Windows.

Telemetry

Telemetry for the operating system and applications must be disabled.

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Data Collection and Preview Builds
Check Allow telemetry
Check Enabled
Select 0- Security [Enterprise Only]
Click Apply

Inventory Collector

Must be disabled.

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Application Compatibility
Check Turn off Inventory Collector
Check Enabled
Click Apply

Windows Defender

The policy of ISU is to use McAfee Antivirus instead so defender should be disabled.

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Windows Defender Antivirus
Turn off Windows Defender Antivirus
Check Enabled
Click Apply

One Drive

The only authorized location to store files is box.com, with which ISU has an agreement.

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select OneDrive
Select Prevent the usage of OneDrive for file storage
Check Enabled
Click Apply

Retrieving Device Metadata

Must be disabled.

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System
Select Device Installation
Select Prevent device metadata retrieval from the internet
Check Enabled
Click Apply

Disabled by Default

If a system does not access a system that manages Highly Sensitive Data such as HIPPA, then these settings can be modified by the user.

Handwriting Data Sharing

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System
Select Internet Communications Management
Select Internet Communications settings
Turn off Handwriting personalization data sharing
Check Enabled
Click Apply

Handwriting Error Reporting

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System
Select Internet Communications Management
Select Internet Communications settings
Turn off Handwriting recognition error reporting
Check Enabled
Click Apply

Steps Recorder

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Application Compatibility
Select Turn off Steps Recorder
Check Enabled
Click Apply

Lock Screen Camera

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Control Panel\Personalization
Select Prevent, enabling lock screen camera
Check Enabled
Click Apply

Location

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Location and Sensors
Select Turn off location
Check Enabled
Click Apply

Sensors

Go to the Group Policy Editor
Select Computer Configuration
Select Windows Components
Select Location and Sensors
Select Turn off sensors
Check Enabled
Click Apply

App Notifications

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System\Logon
Select Turn off app notifications on the lock screen
Check Enabled
Click Apply

Advertising ID

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System
Select User Profiles
Select Turn off the advertising ID
Check Enabled
Click Apply

Sending Writing Info

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Control Panel\Regional and Language Options
Select Prevent, enabling lock screen camera
Check Enabled
Click Apply

Windows Feedback Requests

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select Data Collection and Preview Builds
Select Do not show feedback notifications
Check Enabled
Click Apply

Automatic Driver Update

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select Windows Update
Select Do not include drivers with Windows Updates
Check Enabled
Click Apply

Windows Customer Experience Improvement Program

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select System
Select Internet Communication Management
Select Internet Communication Settings
Select Turn off Windows Customer Experience Improvement Program
Check Enabled
Click Apply

Cortana

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select Allow Cortana
Check Disabled
Click Apply

Location Info

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select Location and Sensors
Select Turn off location.
Check Enabled
Click Apply

Camera

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Select Let Windows apps access the camera
Check Enabled
Check that the User is in control under the options heading
Click Apply

Microphone

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Select Let Windows apps access the microphone
Check Enabled
Check that the User is in control under the options heading
Click Apply

Account Info

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Select Let Windows apps access the account information
Check Enabled
Check that the User is in control under the options heading
Click Apply

Calendar

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Check Let Windows apps access the calendar
Check Enabled
Check that the User is in control under the options heading
Click Apply

Messages

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Select Let Windows apps access messaging
Check Enabled
Check that the User is in control under the options heading
Click Apply

Radios

Go to the Group Policy Editor
Select Computer Configuration
Select Administrative Templates
Select Windows Components
Select App Privacy
Select Let Windows apps control radios
Check Enabled
Check that the User is in control under the options heading
Click Apply

If you need additional assistance, please Contact ITS

0 reviews

Details

Article ID: 74200

Created

Wed 3/20/19 2:51 PM

Modified

Sun 12/17/23 10:59 AM

Updating...

Securing a Windows Computer

Details

Deleting...

Telemetry	Disabled by Default	Sensors	Automatic Driver Update	Microphone
Inventory Collector	Handwriting Error Reporting	App Notifications	Windows Customer Experience Improvement Program	Account Info
Windows Defender	Steps Recorder	Advertising ID	Cortana	Calendar
One Drive	Lock Screen Camera	Sending Writing Info	Location Info	Messages
Retrieving Device Metadata	Location	Windows Feedback Requests	Camera	Radios