The windows sandbox is actually really useful! On my machine it actually had Edge installed.

9:15 Enabling memory integrity makes VirtualBox’s performance tank. I was going through my settings one day and enabled it. A month later when I wanted to use VirtualBox again, I was confused as to why its performance was so bad. Figuring it out was not easy.

What types of services should we stop in the service tab in Windows 10? because many services consume a lot of RAM and CPU.

The Exploit Protection at 2:26 is for using the internal Windows Defender antivirus. If that is disabled, those settings will not work. If you're using a separate antivirus, this is irrelevant, and will be controlled by the separate antivirus, and will disable Windows Defender. Same goes for Application Guard at 5:33 and Reputation Based Protection at 7:30.

Bitlocker is on laptops enabled by default (In the EU), because Microsoft is by EU law required to do everything they can to protect peoples data.

Hyper-V does not have to be enabled to use Windows Sandbox. However, virtualization does need to be enabled. Virtualization is usually disabled by default in the bios settings of most motherboard manufacturers. You can check if virtualization is enabled on your computer by opening the Task Manager, clicking on the Performance tab, and clicking on CPU. On the bottom right, it should say “Virtualization: “ and “Enabled” or “Disabled.”

I would suggest encrypting your desktop with Bitlocker. It's no more intrusive than doing the same on your laptop. And, yes someone could break in your home to steal your desktop. Less likely, but possible. However, what's being missed here is the day you have to replace your hard drive or you sell your desktop. With full disk encryption enabled, the data is not retrievable if the disk is removed and opened on another computer or if you clear the TPM (security chip) on the desktop. Simply formatting the disk is not enough to secure the data on an unencrypted disk. But with full disk encryption, all you have to do is throw away the key and the data is no more meaningful than random junk data. That's the easiest, fastest, and most secure way to decommission old hardware (aside large shredders and acid baths).

Important note for Core Isolation > Memory Integrity, If your PC isn't powerful enough, better balance your needs as it could slow your computer down. To be fair, I'm running my Windows on VM so it is so noticeable.

Security is a teeter totter with ease of use. If you are completely secure, it's unusable and vice versa. It comes down to a balance of secure enough for everyday usability.

I'm in favor of dedicated and detailed videos about those features.

There absolutely is a thing as too much security ... when it becomes so cumbersome that you actively avoid it or cannot function in a reasonable manner then that is too much security.

Thank you Theo. Only thing you missed was to turn on System Restore which is not on by default. Be handy if an update breaks an unsupported machine yes.

Love this channel ever since you stopped doing satire. Such awesome videos and straight to the point information. Love you Thio! 😁

Before enabling bitlocker, please be aware that if you are dual booting your machine then it's not a good idea. It might potentially corrupt the whole boot partition and you'd most likely have to reinstall windows.

For the few of you, who are interested in maxing out Windows's Security, check this guide out. It's very hardcore, but high security has a price....unless you run linux of coursr

Thanks for the very nice recommendations! I myself activated additionally to the ones I had the app protection in the windows features and the for the edge the guard one.

I disable them to get more fps😎

Bitlocker and Windows' Built-In Encryption feature is actually two distinct features, they are not mutually exclusive.

I actually have enabled all of these except for Controlled Folder Access as it has so many false positives. Windows 11 in Insiders Builds also has Smart App Control (although it requires a clean install or a reset to work :( ) Edge also can disable JIT for more security (but with worse performance) if you run it normally or in Application Guard by going into Edge Settings (it was formerly known as Super Duper Secure Mode while it was in beta (I am not even kidding that was the name). Finally there are Attack Surface Reduction (ASR) rules which also requires Windows Pro edition that can increase security quite a bit

Extremely useful video. Thank you

Okay, the Sandbox one alone is godsend. Thanks Thio.

The Most useful channel on KZfaq for explaining new things on our PCs. Thank You!

Bitlocker is the bane of a repair technician. Customers never remember their microsoft logins. :( Still the only windows security measure that actually protects your data. Passwords don't mean a thing.

Personally, as a dev, i would recommend to disable SmartScreen instead. Most of the time, it is redundant as you can already guess if an app is common or not. It also makes it harder and scarier for users to install smaller apps, and not everyone can afford to pay a very expensive license monthly or yearly. This is just a measure that hurts smaller devs a little while it is pretty much useless against malwares anyways. If you're developing in compiled languages, it can also be very annoying to allow your own compiled app to run each time.

My wallpaper now is your "Another Failed Simulation" masterpiece

Also you need to enable Virtualization in BIOS for Hyper Visor and Sandbox to be selectable in the first place. This is kina awkward since on Ryzen having Virtualization enabled seems to interfere with using Ryzen Master for some odd reason and only let you run it. But if you're not overclocking then who cares? Also keep in mind Win10 calls it "Hyper-V," and "Hyper Visor" in Win11 in the list of Windows Features, but they are exactly the same thing. You can enable Hyper Visor with Virtualization disabled, but you're just installed a client-side app that lets you connect to a hypervisor VM being ran on another PC or server on your network.

HyperVisor is really only needed if you run Virtual Machines on your PC where you need the extra security for devices connected through a passthrough to the virtual machine.

for those are using AMD custom resolution before enabling the "Windows-Sandbox" just in case because for some reason when i had the custom AMD Resolution on after i enabled the windows sandbox my display was messed up for example the display was offscreen somewhat but after i deleted my display and re-created it it was working completely fine now it just needed a refresh. 1. disable your custom resolution first from the "AMD Radeon Software (The Red One)" "Gaming > Display (Custom Resolutions)" 2. then enable "Windows-Sandbox" then restart your computer 3. then once done and logged in go into "AMD Radeon Software(The Red One)" and in the menu "Gaming > Display then under the custom color there should be a (Custom Resolutions)" then re-enable it

Most people don't have Pro. I'm still using Windows 10, due to the plethora of negative remarks I've seen, pertaining to Windows 11. I'd like to make a friendly and helpful suggestion that you pitch this for Windows Home users and be a little more Windows 10 savvy. It doesn't inspire confidence when you are continually saying that you're "not sure: about features in Windows 10. You're a KZfaq presenter. If you're not sure, research it first. I hope you take on board these suggestions as constructive criticism, not admonishment. We all appreciate the efforts you've gone to but things must be relevant to "The great unwashed".

Windows sandbox needs virtualization techology enabled in bios?

2:13 ThioJoe, great rundwon on Windows Sandbox! For those wonderng, while it’s perfect for checking out files you’re unsre about, just a heads up, it’s not ideal for everything. Like, don’t expec to run high-end games or tackle sophistcated viruses in it. But for that extra piece of mind with everyday downloads, it’s pretty neat. ThioJoe’s insights are always on point, and it’s cool to see featurs like this geting highlighted.

For Windows Sandbox you haven't to activate the Hypervisor Platform, but "Hyper-V" (virtualization service), and to activate Hyper-V you gotta go in BIOS and make sure the virtualization is supported by CPU and motherboard and activated ;-D

I'm curious about the impact on speed for applications, especially when it comes to games old and new. And ssd operations.

12:05 controlled folder access is an abandoned feature... windows doesnt even automatically whitelist games from xbox game pass that save files in documents

The ONLY security I absolutely NEED: Preventing Microshaft's system destroyer updates! All my software wiped, all software certifications gone, and none of my sites recognized me. Took me 4 days to resume working! That was on a latest model Asus Zenbook. that perfectly until the update.

These features are probably good for security, but they also affect performance, especially perceived latency when opening files and programs. I don't care about security on my gaming computer and i want it to feel fast, so I disable Microsoft Defender altogether.

3:11 Force randomization for images (Mandatory ASLR)

Hey Joe. can you talk about the products of Hak5? They make normal looking USB or lightning cables that have a built in keylogger, can exectue scripts on a device, have a built in wireless access point to controll the cable from the far and many more features. A cable costs between 40 and 160 USD, which is dirt cheap for such a tool. Would you please show such a product and teach the people about how increadibly dangerous it can be, to put in a random usb cable into a device. Most people probably don't think that a USB cable they found somewhere can be extremely dangerous.

Your recommendations caused my CPU temperatures to go from the high 40s to the high 90s.

You've got some great wall paper, Another Failed Simulation and Fall of Midnight.

Some settings require correct BIOS settings to be enabled.

9:20 If the Core Isolation option is not available in Windows settings despite the hardware being supported, the Virtual Machine in the BIOS is most likely disabled. To enable it, go to the motherboard BIOS and look for "SVM Mode" for AMD and "Intel (VMX) Virtualization Technology" for INTEL Systems.

You need to have a CPU that supports VMware (Intel virtualization or AMD) for Windows Sandbox

@ThioJoe, is it me or does the Airline Pilot Kelsey from "74 Gear" youtube channel have very similar mannerism to yours. I couldnt put my finger on it but i always had a feeling that he was reminding me of someone, and recently i realised it was Thio. Anyone else thinks so?

Thanks ThioJoe! I'm pretty savvy but there's always one or two things I forget about, like the Core Isolation setting.

Great features! I have not know about all of them! BTW - Windows PIN instead of simple password should be mentioned here. Bitlocker for all Windows devices (not laptops only) is definitely a right thing to make use of.

A great channel with many amazing tips and tricks for your home pc / laptop setup 🥰😇👍

The more you know! Knowledge is power! 🧠💪

You should make a list of security tools in descriptionb(and ideally the timestamp where that topic starts)

I suggested a Windows sandbox. Not sure if I was the only one but I suggested it at least. I was a member of the insider. Not now tho after Windows 11.

If you have the Home edition you shorten pretty much the process, as the Home version doesn't feature many of these things.

5:57 It does not appear in Windows 11 Home edition, so we can assume you need the Pro edition.

That Sandbox is awesome.

Great video as always. I like your Windows 11 theme, is it a custom theme?

Note that you don’t want to install windows sandbox if you’re using other virtual machines. It has compatibility issues with Vmware workstations and probably also with other virtual machines. And what’s the point of having two virtual machines?

Excellent work and video! Too bad these features aren't on by default. Thanks for sharing

Hardware Benchmarking Windows Vista to 8: What's your Windows Experience Index (WinSAT) score for Aero? Windows 10 to 11: What's your Windows Hardware Security Capability Score? (I just called it score for the Not Supported, Standard, Enhanced, and Secured-core messages). What's the fastest now turned what's the most secure. Times changed...

Yes, I suppose you can't have "too much security", but what about having not enough security? Microsoft Defender Application Guard is not, in any way, shape or form, available for users of Windows 10 Home Edition. The Microsoft Defender Application Guard extensions for Chrome/Brave and Firefox and the companion app both depend completely on you having the main application program itself, which allegedly can be enabled from the Control Panel. I tried that and there isn't even a listing for Microsoft Defender Application Guard in the optional features. I can't even install it in PowerShell as an Admin, it throws an error every time I attempt it. So far, all of the Microsoft-specific documentation I have found says this is only available for Windows 10 Professional, Windows 10 Enterprise, Windows 10 Education for "certain configurations" and Windows 11. I don't know exactly how necessary these apps are, but considering that I'm not in any position to pay money I don't have to Microsoft for an upgrade nor am I ready to migrate to Windows 11 at this time, I think it's safe to say that I will likely never be able to find out. So, if this is absolutely critical to have, I'm not gonna have it, full stop. Unless ThioJoe or somebody else can instruct me on how to get these features installed and working properly in Windows 10 Home, that is.

on win 10 pro 21H1 all exploit protection were all enabled except for image randomization

Although this is a good video, The audience definitely needs to know which version of windows is being spoken about. is it windows 11 student edition or is it ultimate? stuff like that.

1:26 "If you downloaded a program that you think is kinda suspicious" **types "edge" in the search bar**

Just an FYI to anyone who uses cracked software. Dont turn on the majority of these settings because Windows will erase the activator/cracking software. An easy way to enable security AND have those tools on your machine is to convert your folder into a winrar or winzip archive and add it to MS security exclusions list. I cant tell you how many times I've had to re-download something because windows saw it as a threat. By the way Brave is the best browser in the world!

Careful with exploit protection! Chances are, if a toggle is disabled by default there's a reason for it. Be weary of issues and worse stability if you don't know much about what each toggle does or what its risks are

my favorite windows security feature is installing linux /hj windows sandbox is actually really cool though, had no idea that existed!

Thank you Joe

Mine windows 10, is greyed option s for Windows Sandbox and Windows Defender Application Guard.

Awesome video, what software do you use for your start menu? looks kinda like the windows 10 menu.

It would be good to include a warning before the application guard stuff. I put the browser extension on while watching this, and it stops you browsing if you don't have the application guard companion app also installed. BUT that companion app forces you to put your windows account on windows instead of just having a user account. It also can screw with your options if you don't have genuine windows. It disabled dark mode for me, and now my browser is in light mode because chrome was using windows dark mode to determine its colour scheme. That's literally the behaviour of malware, the exact thing this video is meant to be stopping. Please include warnings like that in future.

Sandbox: I have a fresh windows 11 Pro installed. I did what you said and it would not open. Just got that gray box. I called MS tech support and they referred me to the developer and they said they only do business accounts. They said they don't support home users. So, that being said, what can I use as a 3rd party app to take the place of Sandbox?

6:42 broo plz. Delete egde and defender and app guard. Enable vbs boot ot secure launch with eset internet security its works with secure launch . Windows defender slow pc soo hard :/

I can't find MS Defender Application Guard in my Windows Features. Using Win11 Home Single Language 22H2 that came with my Lenovo Legion laptop.

Controlled Folder Access coulda been real useful if it allowed modifications of the protected directories Not a good security practice I know, but for people lacking in their backups they could dedicate a library location as their "backup" for important files and let CFA protect it

I had heard that Windows 11 requires you to use a Microsoft account, but you referred to using a local account in your video. That is good news!

i anable rasonware protection folder but not work for me a make test and nothing block

what can I do as a local user to secure my pc?

If you use Windows device encryption, you can only save the encryption key to your MS account if you're using Windows Pro, otherwise you can only save a local copy. This is at least the case on Windows 10, I haven't tried 11

Enabled all of them except controld folder access because use Bitdefender antivirus and core isolation because have incompatible drivers.

Antimalware Service Executable is the bane of my existence on Windows OS, especially at work where I have less control over it. I get its purpose; however, especially when offline, I just want it to stop interfering in processes, especially when running personally made code. Sometimes, it acts like malware when it take priorty over anything, which both makes sense and infuriating.

You can activate Core isolation by regedit when it's not suported

Thanks! This helped me! ❤️

1:02 keeps saying "virtualization support is disabled in the firmware", says the same thing for the application guard (Yes, my pc is a windows 10 pro and i enabled windows hypervisor platform)

I cant get the Sandbox to work at all. Everything is installed but when i type "sandbox" from the start menu it has no idea what I'm talking about and does a Bing search for it. Does this not work on Ryzen PCs and Windows 10? I have Virtualization enabled in BIOS, Hyper-V installed (management tools and platform and all items under them), and Windows Sandbox checked.. but it's just NO WHERE to be found. What am I missing?

Love your videos why don't I get your notifications when I set it

Thanks ThioJoe, time to disable all these annoying features now!

Is there a way to export firewall rules/settings from Bitdefender, and then import the rules into Windows defender, before I get rid of Bitdefender? Have been looking everywhere to no avail. Thank you.

Hola Tio, thanks for the tips even though most people don't need them as they have the home versions of malware windows 10 / 11

10:48 on my laptop with W11 home bitlocker can not be activated

how do we know there is a virus in the file when opening it in the sandbox which it has no antivirus software or anything? especially malware, they'll operate in the background. How can we tell the sandbox is infected?

I've windows 11 home and can't open app & browser control. What might be the reason?

Yo make a video on how these features work. Didn't find much info online

Hi Theo, Can you make a video or blog for Windows 10 to Win 11 upgrade, what all backup I need to take, just C: or whole hard drive ?

Wasn't there a problem with memory core isolation feature causing games slow down or something?

Video about turning of windows telemetry in win 11 would be useful

Hi, thanks for a great video. I tried activating HVCI setting but it reported a list of incompatible driver instead. I searched internet for a solution and found a complete solution. For a driver with a publisher name, run "pnputil -f -d " without angled brackets, in administrator console. For a driver without a publisher name, run autoruns (included in Sysinternals Suite, can be downloaded from Windows Store) in administrator mode, and navigate to driver tab. There you can disable loading certain drivers. Find the incompatible drivers by name in the list from the Security UI. Now that the all incompatible drivers are either removed or inactive, you can try restarting Windows and see if it works.

Both Windows Sandbox and Application Guard won't enable, they keep saying "Virtualization support is disabled in the firmware". Like, l get Windows Sandbox, maybe l don't even have Windows Pro after all, but wb Application guard?

Malwarebytes Pro has exploit protection.

my windows sandbox had already edge installed but i use windows 10 pro so they might change it in windows 11

Thanks for your sharing

Their is no reputation based protection in my computer what should I do please tell me

What would happen if you delete the administrator account from the user folder?