我的學習手記 A technical geek blog: Windows 10

Showing posts with label Windows 10. Show all posts

Tuesday, February 10, 2026

Windows 10 hardening by Microsoft Security Baseline

1. Download the Microsoft Security Compliance Toolkit 1.0

https://www.microsoft.com/en-us/download/details.aspx?id=55319

2. Copy the LGPO.exe to the folder under script

2. Run Powershell command:

Get-ChildItem -Path "C:\Source\Windows-10-v22H2-Security-Baseline" -Recurse | Unblock-File

PowerShell.exe -ExecutionPolicy RemoteSigned -File .\Baseline-LocalInstall.ps1 -Win10NonDom

3. Reboot the machine

Reference:

Applying Microsoft Security Baselines | STIG and Microsoft Security Baseline-Based Hardening of a VMware Horizon on VxRail-Based VDI Environment | Dell Technologies Info Hub

https://infohub.delltechnologies.com/en-us/l/stig-and-microsoft-security-baseline-based-hardening-of-a-vmware-horizon-on-vxrail-based-vdi-environment/applying-microsoft-security-baselines/

Monday, February 9, 2026

Windows 10 hardening by HardeningKitty - CIS Benchmarks

Reference:

BEST WINDOWS HARDENING TOOLS | ConfigureDefender, HotCakeX, HardeningKitty - Setup Guides

https://www.youtube.com/watch?v=SoceWcFh4z0

Monday, October 27, 2025

Windows 10 using HardeningKitty to harden it

When you click Windows update on Windows 10 you will receive the following message:

As a short term solution for end of support Windows 10, using HardeningKitty to harden it will reduce the risk.

Reference:

https://www.youtube.com/watch?v=SoceWcFh4z0

Windows 10 end of support - Some option for home users who cannot upgrade to Windows 11

After Windows 10 reached its end of support on October 14, 2025, millions of older PCs that cannot upgrade to Windows 11 have become vulnerable unless users take prompt action. Below is a structured summary addressing the three areas you requested: support status, security risks, and user recommendations.

1. End of Support Summary

Microsoft officially ended all updates, including **security patches, bug fixes, and technical assistance**, for Windows 10 on **October 14, 2025**. While Windows 10 will continue to function, unsupported devices are no longer protected against new vulnerabilities. For organizations or users needing extra time, Microsoft offers **Extended Security Updates (ESU)** through October 2026 for a paid extension—mainly serving as a temporary bridge rather than a long-term fix.

2. Security Risks of Unsupported Systems

Running an unsupported operating system poses several hidden dangers:

- **Unpatched vulnerabilities** become permanent entry points for malware and ransomware attackers. Cybercriminals actively target such systems using automated scanning tools.

- **Higher breach rates** are observed—studies show outdated systems are about three times as likely to suffer data breaches.

In short, continuing to use Windows 10 exposes home users to significant cybersecurity and privacy threats, even if the system appears to run normally.

3. Recommendations for Home Users Without New Hardware

**Option A: Migrate to a Linux Distribution**

For users who cannot or do not want to buy a new computer:

- Consider **Lubuntu** or **Deepin**, which are lightweight, stable, and easier for beginners. I installed Lubuntu on my X61 which is 4GB RAM, 64GB SSD for many years which is running well and Deepin on several old hardware e.g. X230, X240 and DELL 5400.

- Linux offers reliable **long-term support and free security updates**, making it suitable for web browsing, office work, and basic computing.

**Option B: Temporary Hardening of Existing Windows 10**

If migration is not immediately possible:

- Enroll in **Microsoft’s ESU program** for one more year of critical security updates.

- Implement **CIS (Center for Internet Security) hardening benchmarks** using automated tools or scripts such as **CIS-CAT Lite** or community **HardeningKitty**, which adjust registry policies, disable risky services, and enforce strong authentication.

- Use **regular offline backups**, **browser isolation**, and a **reputable endpoint security suite** to add layered protection.

Closing Advice:

Unsupported Windows systems are prime targets for modern cyberthreats. Users should either migrate to a maintained platform (e.g. Linux) or apply stringent CIS-based Windows hardening as a short-term safeguard. Long-term reliance on Windows 10 without updates is not recommended for security or privacy reasons.

Sunday, May 19, 2024

How to find which Access Point (AP) connected on Windows 10 / 11?

To find a AP which is your laptop connected, you can run the following command:

netsh wlan show in

There is 1 interface on the system:

Name : Wi-Fi

Description :

GUID :

Physical address :

State : connected

SSID :

BSSID : <This is the MAC address of the AP you connected>

Network type : Infrastructure

Radio type : 802.11n

Authentication :

Cipher :

Connection mode : Auto Connect

Channel :

Receive rate (Mbps) :

Transmit rate (Mbps) :

Signal : %

Profile :

Hosted network status : Not available

Sunday, February 4, 2024

Windows 10 System Clock Display up to seconds

The registry parameter is able to change under normal user right and you need to reboot to make it effective.

Wednesday, November 1, 2023

Freeware to enhance Microsoft Defender Security (Windows 10 and 11)

Microsoft Defender User need to consider to use DefenderUI or Configuredender to enhance your security since they able to enable many hidden security features of Microsoft Defender.

More detail:

DefenderUI (Need to install) and Configuredefender (No need to install)

https://www.defenderui.com/

https://github.com/AndyFul/ConfigureDefender

Tuesday, October 24, 2023

Windows 10 cannot connect Internet

Symptoms:

Cannot ping public IP address
Cannot resolve DNS
Wireless/Wired LAN show connected and it show able to connect to Internet
Each time connect and disconnect will able to ping in few package then drop the connection

Solution:

Run command : "netsh winsock reset" and reboot the machine

Wednesday, October 4, 2023

How to turnoff new message notifications of WhatsApp and Outlook email on Windows 10 lock screen?

Go to "Notifications & actions" to turn off those app notifications setting.

Reference:

Unwanted Lock Screen Message - How to turn off? - Microsoft Community

Sunday, April 9, 2023

Bginfo on Windows 10 and show active IPv4 address only

To run Bginfo to ALL users:

Now navigate to the location of the shortcut and edit the target path to be the following:

"C:\Tools\BGInfo\Bginfo64.exe" "C:\Tools\BGInfo\config.bgi" /timer:0 /nolicprompt /silent

Next Copy that shortcut and it in "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

Reference:

https://serverfault.com/questions/451791/run-bginfo-at-startup-for-all-users

For show active IP v4 only, there are vb script:

strMsg = ""

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set IPConfigSet = objWMIService.ExecQuery("Select IPAddress from Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'")

For Each IPConfig in IPConfigSet

If Not IsNull(IPConfig.IPAddress) Then

For i = LBound(IPConfig.IPAddress) to UBound(IPConfig.IPAddress)

If Not Instr(IPConfig.IPAddress(i), ":") > 0 Then

strMsg = strMsg & IPConfig.IPAddress(i) & vbcrlf

End If

Echo strMsg

IP.vbs

Reference:

https://social.technet.microsoft.com/Forums/scriptcenter/en-US/bb74c2eb-eca2-455d-a270-8dd0f3d195e6/wmi-query-to-retrieve-only-active-ipv4-address?forum=ITCG

Windows 10 Hardening and audit tool (HardeningKitty)

You can use HardeningKitty to check your configuration and also it will provide a scoring for your reference:

HardeningKitty and Windows 10 Hardening

https://github.com/0x6d69636b/windows_hardening

There are TWO items you should disable : PowerShell v2 and SMB v1

Disable PowerShell v2

Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

https://www.thewindowsclub.com/disable-powershell-v2-windows

Disable SMB v1

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3?tabs=server

The following website provide you some advice configuration about hardening and also you can import some attack surface reduction rules:

Configure Attack Surface Reduction rules

https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-microsoft-windows-10-version-21h1-workstations

Thursday, December 8, 2022

How to fix failed to login Windows 10 by using Microsoft account

Use a local administrator to login the machine
Run "sfc /scannow" in command prompt
Run "Dism /Online /Cleanup-Image /ScanHealth" in command prompt
Run "Dism /Online /Cleanup-Image /CheckHealth" in command prompt
Run "Dism /Online /Cleanup-image /RestoreHealth" in command prompt
Reboot your machine
You should able to use your Microsoft account to login now

Reference:

Fix: "We can't sign in to your account" Error on Windows

https://www.youtube.com/watch?v=I3vpwuRoW9I

Friday, September 23, 2022

Fix Minecraft High CPU Usage & Your Laptop / PC Overheating For Windows 11/10

https://www.youtube.com/watch?v=DsEA2DFvQ7Q

Tuesday, June 21, 2022

How to set Edge IE mode longer than 30 days or 90 days (Max: until 2099)

Credit to LesFerch who written this vbs. Thank you LesFerch.

Download the IEModeExpiryFix.vbs to set the date to 2099

https://github.com/LesFerch/SampleCode/blob/main/VBS-misc/IEModeExpiryFix.vbs

Double click the IEModeExpiryFix.vbs

Then ALL website under Internet Explorer mode pages expires will change to xx/xx/2099

Before:

After:

If you want to add the website by using this vbs, use the "AddSites" in the vbs

AddSites = http://www.abc.com/|http://www.bbb.com/

Remark: Entries must end with a slash unless the URL ends with a file such as .html, .aspx, etc

For example: http://www.abc.com/

http://www.abc.com.hk/index.html

https://www.aaa.com/aaa/

*You need to put ALL website in one line

** You can create multiple file to add different website to append to the list e.g. File1 have 5 URL, File 2 have 4 URL. Then 9 URL will add into the list after you run both of them.

***If you put multiple AddSites line in same file, it will add the final line website only

Constraints and limitation:

Locale setting must be consistent with the date format. For example, if you run this script on Chinese Windows 10, it will not work. You need to make change on the Setlocale("en-us") to Setlocale("zh-hk" or any locale you are using)

For more details: Available Language Packs for Windows | Microsoft Docs

If you running the script but the locale did not correct, it will crash your Edge profile.

The script did not work if your edge login Microsoft account

Verified:

Tested on Windows 10 21H2 domain joined, run by normal domain user account.

Tested on Windows 10 21H2 workgroup machine, run by normal local user account.

Reference:

https://answers.microsoft.com/en-us/microsoftedge/forum/all/how-to-extend-ie-mode-more-than-30-days/d90a3656-682f-46ca-843b-9b53cb59f4c7?page=1

Thursday, May 19, 2022

Windows 10 21H2 on VMware VDI Horizon 8 Version 2111 ESB with Zoom

The latest release Zoom which is required to deploy due to a CVE-2022-22782 and CVE-2022-22786 vulnerability:

Zoom for VDI 5.10.2

Zoom plugin for Hozion 5.10.2

Windows 10 21H2 on VMware VDI Horizon 8 Version 2111 ESB with Cisco Jabber

The following combination will be consider more stable and hit less bugs so far:

VMware Agent – 8.4.0-18964730

VMware Horizon Client - 8.4.1-19480429

Cisco Jabber 14.1.1 (14.1.1.56904 Build 306904)

Cisco Jabber JVDI agent 14.1.1

Cisco Jabber JVDI Client 14.1.1

Sunday, February 6, 2022

What need to be aware if your Lenovo X240 install Windows 10 10240 (1507) and upgrade to the latest version?

Run Windows Update after the installation immediately
Do not install Lenovo System Update to apply any driver until your machine running on 20H2 or later version
Do not run the Windows media creation tool or run the Windows 10 upgrade assistant tool to upgrade your machine from Windows 10 10240 to 21H2 directly
After you using the Windows Update to upgrade your machine to 20H2, then you can install driver, software and also using the upgrade assistant tool to upgrade to 21H2
Block your machine to upgrade to Windows 11 by changing the target version to 21H2

How to stop your machine to upgrade to Windows 11 when you receive a message your machine will upgrade to Windows 11 after boot?

Stop the Windows Update Service
Delete the file in "Software Distribution" folder which can be found in "C: \Windows".
Go to registry to set the Windows update target release version to 21H2
Reboot your machine without click the upgrade
Go to https://www.microsoft.com/en-hk/software-download/windows10 to run the Windows 10 upgrade to upgrade your machine to Windows 10 November 2021 Update (21H2)

https://www.howtogeek.com/765377/how-to-block-the-windows-11-update-from-installing-on-windows-10/

https://www.istarapps.com/delete-windows-update-files-completely.html

https://www.ghacks.net/2020/06/27/you-can-now-set-the-target-windows-10-release-in-professional-versions/

Thursday, February 3, 2022

Windows 10 Insider on Dev Channel but failed to upgrade to Windows 11

My machine is X220 which is not compatible to upgrade to Windows 11, since I cannot leave the Insider Dev Channel without reinstall the machine without data loss….So, I decided to force my machine to upgrade to Windows 11 GA to keep my data and also installed program.

Since my machine did not have TPM, I need to upgrade Windows 11 without TPM