I am setting up a Privileged Access Workstation (PAW) to access a whitelist of websites. Currently I have been following this guide on Github by unassassinable and applying the latest Windows 10 security baselines.

  1. Is there any documentation or guides that are focused just on securing / hardening a Windows 10 install for whitelisted website access and without Active Directory.

  2. Can Windows 10 Pro be locked down sufficiently or is Enterprise required to truly harden a system

  3. Which browser is best for this job? I was expecting to use Chrome with Group Policies set to lock it down.

2 Answers 2


I am the original author of that github

  1. There is! You have a few options and I will tell you what I have found to be the best for enterprise security. With a high maintenance cost, you can do this totally free using the user proxy section of my github page linked in your post. However, it is difficult to maintain. If your company can afford it, invest in a good CASB solution. I am currently using Netskope. Do recommend!

  2. Without Pro, you lose things like AppLocker (fine if you use a commercial application whitelisting platform like BeyondTrust for Windows or Thycotic Privileged Manager...there are many). You also lose virtualization based security (credential guard, device guard, etc). Other stuff - Google "windows 10 enterprise vs pro".

  3. Google Chrome, Edge, and Firefox ESR all come with CIS benchmarks. Just make sure whatever you go with, you have an app-whitelisting solution because browsers these days do not require local admin as users can install them to their AppData location rather than Program Files (which requires admin rights).


You can also consider virtualization/sandbox technology when using exposed software (Browsers, SSH Clients) to access the internet from PAWS, like the one built into Windows 10, this works with both Pro or Enterprise:


Consider using a complete sandboxed environment to access content on the internet, like VMWare Workstation on those machines, or if you are paranoid - specific ones that you can connect to that in turn are sectioned off even more.

In an environment that is virtualized on PAWS, or distanced from the PAWS, you have a bit more freedom to do what you need to get the job done as you just can revert back to snapshot, and you don't have to care as much about GPOs and hardening.

You can also script VMs to start in a given state so the administrators don't even have to think about resetting the VM State.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .