Basic setup/security for laptop

[CAT-THE-FIFTH]

Sometimes with secondhand laptops,the reinstalled Windows might be one of those copies with a key from a dodgy reseller,so you need to be wary. Also,you need to check which version too. If its an ex-business laptop,it might have Windows Enterprise installed on it over the shipped install,which is deployed as bulk image,and is licensed by the company per user. If this is the case,the install might deactivate itself.

However,luckily Dell laptops have a unique service tag,which can be entered on their website,and at least for the business laptops I have used,the original Windows image can be downloaded:
https://www.dell.com/support/home/uk/en/ukbsdt1

It will also give details of the original order and original shipped configuration.

Avoid Avast as they have been shown to sell user data:
https://www.cnet.com/news/antivirus-...browsing-data/

Avira is OK,and Kapersky and Bitdefender get some good reviews. You should also install an on-demand antispyware scanner too - malwarebytes and superantispyware are popular.

Also for Firefox and Chome there are certain extensions which should be installed if you want to maximise protection.Chrome is probably OK if you don't login with your Google account,but if you do it will definitely be able to put two and two together.

Examples:
1.)Privacy Badger/Adblock Plus/uBlock Origin

https://en.wikipedia.org/wiki/Privacy_Badger
https://en.wikipedia.org/wiki/Adblock_Plus
https://en.wikipedia.org/wiki/UBlock_Origin

These block cookies,adverts and other forms of tracking between websites - you need to choose one of them.

2.)Noscript

https://en.wikipedia.org/wiki/NoScript

Used to block scripts on the page.

Flashblock Plus for blocking flash content,but flash is not EOL so probably not really required now.

[fredwck]

I'm probably missing something. If you got an activated W10 laptop, what's wrong with using that activation key and doing a fresh reformat+reinstall W10? You can download W10 for clean copy. Since you know specs you can get the drivers too. Then it's a fresh start for your free AV choice etc etc.

[ik9000]

^true that. But it's then turning off all the bloat and crap that MS wants you to have, but no sane person would opt into (IMHO)

[Saracen999]

I'm probably missing something. If you got an activated W10 laptop, what's wrong with using that activation key and doing a fresh reformat+reinstall W10? You can download W10 for clean copy. Since you know specs you can get the drivers too. Then it's a fresh start for your free AV choice etc etc.

I don't yet know if it's activated or not, or for sure if the W10 install is legit. I've just been handed the machine, almost completely out of battery. I know it boots to W10 but nothing much more than that. My guess is it is legit, but no idea on activation. I've been asked to do a basic setup for a friend, which is tricky as I don't use W10 myself. I'm either W7 and earlier legacy, or Linux.

[ik9000]

you can tell re activation same as win 7 - and in an offline state:
cmd prompt - admin
>slmgr /dlv
this will display licence state and information, including last 4 digits of product key. Take a screenshot snip for future reference. It should say here if it has been activated, and what kind of licence it thinks it is.

Then use one of the below to obtain the whole key. Compare the key and licence serial - do they match the above? If so problem solved.

vbs version (tried and works): https://gallery.technet.microsoft.co...ndows-7367e9c5
powershell version: https://gallery.technet.microsoft.co...ndows-85379640

not tested:
alternate powershell version with GUI: https://gallery.technet.microsoft.co...oduct-6b5e6f6e

[Saracen999]

I'd forgotten all about slmgr, it's been so lonng since I've used it.

Thanks, ik. That'll tell me more about what I do/don't need to worry about.

[DanceswithUnix]

know there was a CD/DVD supplied but I don' rememher seeing Dell branding all over it. It looked more like an, erm, third-party disk.

The only thing that makes that odd is that usually when you download an OS rescue disk from Dell you put it onto USB as no-one has DVD drives any more. My laptop was shipped with a "rescue partition" which I junked when I put Linux on there, and when restoring it to Windows I used the service tag to get Dell to point me to a OS install image which I put onto USB stick.

The rather expensive brand new laptop did not come with OS media.

But otherwise, I have yet to come across a Linux only Dell laptop. A few workstations sure, but when I got my lappy getting it with Linux or Windows installed was basically the same cost, so I got Windows and installed Fedora over it so I had the option to go back in the future. So they all seem to have a Windows licence built in.

[ik9000]

you can stick the ISO onto whatever can't you?

[CAT-THE-FIFTH]

If you enter the Dell service tag,you can download the original Dell Win10 ISO image. It also gives you a list of updated drivers and updated firmware. You should be updating the BIOS to the latest versions with Spectre/Meltdown patches.

My laptop is a few years old,but has a further BIOS update in 2020. If not the laptop is more at risk of attacks based around these hardware based flaws.

I have done that for secondhand Dell business laptops before.



Dell even gives you a tool to re-install Windows:
https://www.dell.com/support/home/uk...verytool/wt64a

Install it to a USB drive and you get the latest factory image for your laptop,which will essentially reset it back to factory settings.

In fact it is good practice to reinstall windows on a secondhand machine anyway,as you have no clue what the previous owner was downloading on it,and what crud has infected it.

So even if you install AV,etc it can already be compromised.

[spacein_vader]

As a W10 almost novice, my usage of a firewall (usually Comodo) on W7 etc was primarily to watch/block what tried to connect/talk out from the PC.

Browser-wise, I've used Firefox or Opera for ages. Always got on well with AVG. My PW Mgr ceasedcdevelopmeny ages back, but I keep hearing good things about LastPass.

I sense a broad concensus on here, and a shortlist is rapidly emerging. Keep 'em coming, guys.

Not sure Opera is still trustworthy these days. For me Firefox with HTTPS Everywhere, EFF Privacy Badger, and Dark Reader (not security just allows you to put all websites in dark mode,) are essential, with Firefoxs in built Do Not Track feature turned on. I am behind a Pi-Hole too though so you may need more that that

I use KeePass for passwords as its well established, open source and has many plugins/versions for different OS and browsers. Some of the commercial variants integrate with browsers etc a bit more seamlessly though if that's a consideration.

For AV they all seem to be snake oil these days and Microsofts built in Defender seems no worse than the rest so I stick with that. The built in Windows Firewall subsystem is actually pretty powerful, but the default interface is very basic and the default settings only account for inbound traffic. Rather than replace it altogether there are several front-ends available that plug into the existing firewall. I use Windows Firewall Control which has been bought by Malwarebytes (who haven't ruined it, at least yet,) but slightly clunkier open source versions are available.

Finally O&O ShutUp10 is a must, it saves going though all of Windows 10s setting screens and management panels to turn off as much snooping as possible in one place, it even explains each setting and what may/will break if you disable it.

[jimbouk]

I always nuke as much Windows 10 stuff as possible using (admin) powershell with "Get-AppxPackage * | Remove-AppxPackage", throws a load of errors but it did clean things out and you can rerun after updates.

[Saracen999]

Right, so far, (apparently) so good.

It's W10 Home and appears to be legit, licensed and activated. Build 1703.

Next (I think) .... run Updates. As soon as i get it talking to the web.

[spacein_vader]

Right, so far, (apparently) so good.

It's W10 Home and appears to be legit, licensed and activated. Build 1703.

Next (I think) .... run Updates. As soon as i get it talking to the web.

If it's on 1703 the updates will take a while. Each of windows 6 monthly builds will need to be run through (it can't just jump to latest,) and takes a while including reboots. It may also want to run the cumulative update packages for each build before it'll do the next one, which is another reboot.

Monolithic OS's FTW eh?

[Chaudry]

For a laptop I'd say full disk encryption should be on the list.

[ik9000]

whatever happened to good old service packs FFS

[ik9000]

no wait - I'm being dumb. Burn the latest ISO and do a clean win10 install. So long as the thing has been activated before it will detect the hardware and apply the licence automatically. You can jump straight to 1909 that way