Printable View
A friend has bought a new (used) laptop that's had a basic (and no doubt old) W10 reinstalled as completely fresh.
And they've asked me (of all people) to do a basic configuration to make it safe to use.
So what's current thoughts? Turn on (if it isn't already) built-in AV/Firewall, etc?
Download selected "free" stuff?
Best "safe" browser, etc?
Any help much appreciated.
Make sure Windows has all its updates is probably the biggest. For all the whinging MS get about intrusive updates, not being updated is by far your biggest threat.
I'm tempted to go back to the built in Microsoft AV, they all suck and Avast is getting intrusively nagging. Microsoft AV and firewall should be automatically working.
Check for any device drivers it might need. Look for an updated BIOS.
So basically, fire it up, plug it in to ethernet and wait for it to do it's thing?
Then maybe tweak settings later?
I currently don't have their email? Can it still be done on a local account?
Thanks, Dances
You should be able to skip any "sign in to Microsoft" stage, though with the latest Windows you have to disconnect networking for that bit for it to give up.
I'll give it a go later/tomorrow.
Thanks, DwU.
I normally go through the Settings/Privacy and turn OFF as many things as possible.
there are two bits of free software worth looking at.
O&O shutup10 https://www.ghacks.net/2015/08/14/co...privacy-tools/
and
dbotnet: https://www.ghacks.net/2020/02/01/wi...-improvements/
FYI people 1809 is the last version with ablility to do phone activation. They have nobbled the SLUI.exe to remove it in the 19xx versions.
I've just switched away from Avast for exactly that reason.Quote:
Originally Posted by DanceswithUnix
As above, you can skip any MS account stuff - you can also now say no to cortana and there's a lot of privacy permissions that MS have to explicitly ask for which you can say no to.
Firefox probably a good browser choice - Chrome is definitely one of the safer ones with exploits patched very quickly, but you are giving a lot of data to Google by using it (and it routinely scans to find out what else you have on your computer). Two extensions I'd recommend are HTTPS everywhere (defaults to trying to find a secured version first) and an ad-blocker of your choice. Go into firefox privacy settings and check 'tell websites I do not want to be tracked'.
Get your friend to use a password manager too - passwords should never be re-used and a manager is the only sane way of operating like that. You can use ones built into Firefox/Chrome, or a third party one like lastPass.
When I switched my 1909 install to my current build I had to reactivate, but it still showed the option in the Activation section of the settings, and the alternative option to run slui.exe 4 launched the same screen as the option did, to allow it (with the network connection still being plugged in, in case anyone wondered if that was a difference).Quote:
Originally Posted by ik9000
Activation is one of my concerns. I'm told it's a clean install, but .... of what?
It's a Dell laptop originally supplied with W10 so, cross-fingers, it's legit. I really can do without sorting that out if it isn't.
You can't generate the key to read to them to get the phone code nor find the screen to get the phone number to call anymore. Sounds like if you already have done that previously and have the key you might still be able to enter it which is goodQuote:
Originally Posted by Output
A Dell laptop should just work.Quote:
Originally Posted by Saracen999
Start->Settings->Update & Security->Activation
... should give you a screen saying it is activated. It is normal these days for the motherboard BIOS to have the Windows key in the BIOS (hidden in the ACPI table). You can read it out quite easily in Linux by catting a file in the /proc filesystem, I presume there is a 100MB GUI application to do the same in Windows ;) :D
Even before Windows 10 it was normal that a Dell Windows install CD would see it was on a Dell PC and just work. OFC that meant that a non Dell disk doesn't work.
I always install AVG Free, CCleaner and Uninstall Tool. I used to get a Spyware package but AVG does all that now.
If you use a router they usually have a hardware firewall, so Windows FW is usually off. Defender is usually off.
Chrome, with optional IE, sometmes Chrome can't *quite* handle some things....
Finally, I use LastPass for password management.
I know W10 is installed, because it was booted for me. Beyond that, currently in the dark.
I know there was a CD/DVD supplied but I don' rememher seeing Dell branding all over it. It looked more like an, erm, third-party disk.
But IIRC, it was W10 "Home" so why would anyone mess about with 3rd party OS discs? It' not like it's Pro, or whatever. Rhetorical question.
Lappy is currently charging. I guess I'll find out more shortly.
/Wonders if I stuck Ubuntu on it and said it was a new W10 UI, they'd rumble me? :;
As a W10 almost novice, my usage of a firewall (usually Comodo) on W7 etc was primarily to watch/block what tried to connect/talk out from the PC.Quote:
Originally Posted by g8ina
Browser-wise, I've used Firefox or Opera for ages. Always got on well with AVG. My PW Mgr ceasedcdevelopmeny ages back, but I keep hearing good things about LastPass.
I sense a broad concensus on here, and a shortlist is rapidly emerging. Keep 'em coming, guys. :D
I would always install 7zip, notepad++ and antrenamer. They are so useful. The new win10 powertools are worth considering too. I would also set up the old win7 photoviewer so that it at least shows in the open-with menu even if they decide they don't want to make it default. I find the new photoviewer a real pain. It won't skip photos if you've zoomed in etc. Talk about breaking a good thing. Oh and back up snipping tool while you can still get to the .exe file. They are about to bork that in the next release too.
Sometimes with secondhand laptops,the reinstalled Windows might be one of those copies with a key from a dodgy reseller,so you need to be wary. Also,you need to check which version too. If its an ex-business laptop,it might have Windows Enterprise installed on it over the shipped install,which is deployed as bulk image,and is licensed by the company per user. If this is the case,the install might deactivate itself.
However,luckily Dell laptops have a unique service tag,which can be entered on their website,and at least for the business laptops I have used,the original Windows image can be downloaded:
https://www.dell.com/support/home/uk/en/ukbsdt1
It will also give details of the original order and original shipped configuration.
Avoid Avast as they have been shown to sell user data:
https://www.cnet.com/news/antivirus-...browsing-data/
Avira is OK,and Kapersky and Bitdefender get some good reviews. You should also install an on-demand antispyware scanner too - malwarebytes and superantispyware are popular.
Also for Firefox and Chome there are certain extensions which should be installed if you want to maximise protection.Chrome is probably OK if you don't login with your Google account,but if you do it will definitely be able to put two and two together.
Examples:
1.)Privacy Badger/Adblock Plus/uBlock Origin
https://en.wikipedia.org/wiki/Privacy_Badger
https://en.wikipedia.org/wiki/Adblock_Plus
https://en.wikipedia.org/wiki/UBlock_Origin
These block cookies,adverts and other forms of tracking between websites - you need to choose one of them.
2.)Noscript
https://en.wikipedia.org/wiki/NoScript
Used to block scripts on the page.
Flashblock Plus for blocking flash content,but flash is not EOL so probably not really required now.
I'm probably missing something. If you got an activated W10 laptop, what's wrong with using that activation key and doing a fresh reformat+reinstall W10? You can download W10 for clean copy. Since you know specs you can get the drivers too. Then it's a fresh start for your free AV choice etc etc.
^true that. But it's then turning off all the bloat and crap that MS wants you to have, but no sane person would opt into (IMHO)
I don't yet know if it's activated or not, or for sure if the W10 install is legit. I've just been handed the machine, almost completely out of battery. I know it boots to W10 but nothing much more than that. My guess is it is legit, but no idea on activation. I've been asked to do a basic setup for a friend, which is tricky as I don't use W10 myself. I'm either W7 and earlier legacy, or Linux.Quote:
Originally Posted by fredwck
you can tell re activation same as win 7 - and in an offline state:
cmd prompt - admin
>slmgr /dlv
this will display licence state and information, including last 4 digits of product key. Take a screenshot snip for future reference. It should say here if it has been activated, and what kind of licence it thinks it is.
Then use one of the below to obtain the whole key. Compare the key and licence serial - do they match the above? If so problem solved.
vbs version (tried and works): https://gallery.technet.microsoft.co...ndows-7367e9c5
powershell version: https://gallery.technet.microsoft.co...ndows-85379640
not tested:
alternate powershell version with GUI: https://gallery.technet.microsoft.co...oduct-6b5e6f6e
I'd forgotten all about slmgr, it's been so lonng since I've used it.
Thanks, ik. That'll tell me more about what I do/don't need to worry about.
The only thing that makes that odd is that usually when you download an OS rescue disk from Dell you put it onto USB as no-one has DVD drives any more. My laptop was shipped with a "rescue partition" which I junked when I put Linux on there, and when restoring it to Windows I used the service tag to get Dell to point me to a OS install image which I put onto USB stick.Quote:
Originally Posted by Saracen999
The rather expensive brand new laptop did not come with OS media.
But otherwise, I have yet to come across a Linux only Dell laptop. A few workstations sure, but when I got my lappy getting it with Linux or Windows installed was basically the same cost, so I got Windows and installed Fedora over it so I had the option to go back in the future. So they all seem to have a Windows licence built in.
you can stick the ISO onto whatever can't you?
If you enter the Dell service tag,you can download the original Dell Win10 ISO image. It also gives you a list of updated drivers and updated firmware. You should be updating the BIOS to the latest versions with Spectre/Meltdown patches.
My laptop is a few years old,but has a further BIOS update in 2020. If not the laptop is more at risk of attacks based around these hardware based flaws.
I have done that for secondhand Dell business laptops before.
https://i.imgur.com/2ENqUuV.png
Dell even gives you a tool to re-install Windows:
https://www.dell.com/support/home/uk...verytool/wt64a
Install it to a USB drive and you get the latest factory image for your laptop,which will essentially reset it back to factory settings.
In fact it is good practice to reinstall windows on a secondhand machine anyway,as you have no clue what the previous owner was downloading on it,and what crud has infected it.
So even if you install AV,etc it can already be compromised.
Not sure Opera is still trustworthy these days. For me Firefox with HTTPS Everywhere, EFF Privacy Badger, and Dark Reader (not security just allows you to put all websites in dark mode,) are essential, with Firefoxs in built Do Not Track feature turned on. I am behind a Pi-Hole too though so you may need more that thatQuote:
Originally Posted by Saracen999
I use KeePass for passwords as its well established, open source and has many plugins/versions for different OS and browsers. Some of the commercial variants integrate with browsers etc a bit more seamlessly though if that's a consideration.
For AV they all seem to be snake oil these days and Microsofts built in Defender seems no worse than the rest so I stick with that. The built in Windows Firewall subsystem is actually pretty powerful, but the default interface is very basic and the default settings only account for inbound traffic. Rather than replace it altogether there are several front-ends available that plug into the existing firewall. I use Windows Firewall Control which has been bought by Malwarebytes (who haven't ruined it, at least yet,) but slightly clunkier open source versions are available.
Finally O&O ShutUp10 is a must, it saves going though all of Windows 10s setting screens and management panels to turn off as much snooping as possible in one place, it even explains each setting and what may/will break if you disable it.
I always nuke as much Windows 10 stuff as possible using (admin) powershell with "Get-AppxPackage * | Remove-AppxPackage", throws a load of errors but it did clean things out and you can rerun after updates.
Right, so far, (apparently) so good.
It's W10 Home and appears to be legit, licensed and activated. Build 1703.
Next (I think) .... run Updates. As soon as i get it talking to the web.
If it's on 1703 the updates will take a while. Each of windows 6 monthly builds will need to be run through (it can't just jump to latest,) and takes a while including reboots. It may also want to run the cumulative update packages for each build before it'll do the next one, which is another reboot.Quote:
Originally Posted by Saracen999
Monolithic OS's FTW eh?
For a laptop I'd say full disk encryption should be on the list.
whatever happened to good old service packs FFS
no wait - I'm being dumb. Burn the latest ISO and do a clean win10 install. So long as the thing has been activated before it will detect the hardware and apply the licence automatically. You can jump straight to 1909 that way
I'm not even sure where I'd get the latest ISO, but I'm not sure I want to get invopved in re-installing. This is supposed to be a quick, basic setup. No battle plan survives the first shot, eh?
Presumably, between each update / reboot phase, I can power off and wait. i.e. the wife needs the net connection tomorrow, without an update clogging it up?
saracen if you just want latest ISO you can get it direct from MS site, if you want a specific older ISO you have a few more hoops but I can PM you details.
https://www.microsoft.com/en-gb/soft...load/windows10
Please excuse idiot-grade questions but I'm more used to W7 install, service pack then security and critical patches.
So I can :-
1) Connect up, update and let it install build after build after build. Or
2) DL the latest ISO, shove it on (say) an external HD, stick the installer on a USB memory stick and reinstall direct to current build.
Here's the not-quite so idiot question ..... I am curently not that well, and really don't want to end up trying to unbork a borked laptop after a reinstall or build-update fail.
Which of the above is least likely to end uo borking things?
I would assume 2) ???
Also try and update to a Spectre/Meltdown patched BIOS if there is an update available.
Before or after re-install?Quote:
Originally Posted by CAT-THE-FIFTH
It's a Dell Inspirion lappy, IIRC.
Probably before - the BIOS update actually updates the CPU microcode. Just make sure the battery is fully charged and its plugged into the mains. The Dell BIOS is usually custom,so here is some information on how to do it on their systems:Quote:
Originally Posted by Saracen999
https://www.dell.com/support/article...pdates?lang=en
https://www.dell.com/support/article...system?lang=en
Edit!!
If you can do the update in the BIOS it is better than using a Windows utility.
I think I'll get them to do their own BIOS update. For what was supposed to be a basic W10 setup, this is getting rather complicated.
Welcome (back) to Windows! Missed it?Quote:
Originally Posted by Saracen999
Like a dose of Pox.Quote:
Originally Posted by spacein_vader
Chicken pox, of course.
When building machines on Win 10 I tend to do the following....
Setup with the defaults as mentioned above as the AV built in is as good as anything free with less overhead.
If you got a TPM (which you do on most newer devices) ensure Bitlocker is enabled. It should be by default but check and turn on if not.
Go to a website called Ninite which helps easy install of the applications you're going to want, 7-Zip, Notepads.
Don't install a browser other than the new edge. Its built on Chrome and will get its updates via Windows. Firefox (I love) but it's dying and its something else to have to update.
Patch it and ensure auto updates are enabled.
General rule is stay aware from any "free" cleaning or so called tools where Windows has it's own version. It lines you up for more risk and fill your device with bumf.
You could go to advance boot options and "Reset this PC" it should set it to default settings as if it was brand new I believe. You can choose to keep personal files or not.
After reset connect to internet and get all the updates.
Install free AV, I would use AVG and Malwarebytes free for example.
Get other useful tools like others mentioned. Notepad++, CCleaner etc.
Should be fine from then on.