1

I'm planning to do a fresh install of Windows 10 on my mother's computer. Despite it has Pro version right now, I wonder if I should use Home version instead, which is also called Single Language.

After some search, I found that Home doesn't has some features like Remote Desktop or Local Group policies, which made me think that maybe this version would be more secure for a common user.

Is that a correct assumption? I even wonder if, despite this lack of features could reduce attack surface, the possible lacking of another features could reduce the overall system security at the end of the day. What do you think about it?

I'm also planning to install a third-party firewall after it and block inbound connections and some communications with another devices inside the network. Is it possible to Home version block this type of thing?

2
  • Will your mother be an admin on her computer? Or will she be a standard user?
    – Unknown
    Feb 2, 2022 at 2:15
  • @Unknown standard user
    – Mycroft
    Feb 2, 2022 at 18:39

2 Answers 2

3

It's true that Home has reduced attack surface compared to Pro. On the other hand, those features of Pro are optional (e.g. you can easily disable the remote desktop protocol server). However, it's also harder to secure Home edition well, in some ways. It doesn't have some features like Encrypting File System or user-controllable BitLocker, it's possible to modify ACLs on files but it's missing the advanced GUI for doing so, and it doesn't have a lot of the UI for manipulating Windows security policies such as most advanced changes to user capabilities (it's missing secpol.msc, the Local Security Policy editor, and also the Group Policy Editor). Technically many of those settings are still present in Home; you just have to know far more about the Windows Registry than any sane person would.

For a user who isn't ever going to mess with advanced firewall rules or change any security settings beyond moving UAC between its four options exposed in the Control Panel, Home is fine, and maybe ideal. For people who want to require a boot-time passphrase for BitLocker and control which users are allowed to create symlinks, you want a higher edition.

2
  • What you said about firewall rules worried me a little. I'm also planning to install a third-party firewall after it and block inbound connections and some communications with another devices inside the network. Is it possible to Home version difficult this type of thing?
    – Mycroft
    Jan 20, 2022 at 17:33
  • 1
    Third-party firewalls are completely unaffected. I think some versions of Windows don't give access to the "Advanced" firewall GUI configuration tool for Home edition, limiting you to very basic GUI configuration (I forget if that's true of Win10/11; I haven't run Home edition in many years), but in any case the advanced firewall config tool only applies to the built-in Windows firewall. Also, I think that even if you can't use the advanced GUI, you can still use netsh.exe to create detailed firewall rules.
    – CBHacking
    Jan 21, 2022 at 10:48
2

It's pretty unlikely that that Remote Desktop or Local Group policies are going to be an attack surface you need to worry about in this case.

By default, Remote Desktop is turned off. When you hear about people hacking machines using Remote Desktop it isn't the attacker convincing the user to turn it on and give them the password. It's usually goes like this:

  • User sets up Remote Desktop, uses a weak password, and leaves it on 24/7.
  • Attacker scans the internet looking for devices that are running Remote Desktop
  • Attacker cracks weak password and gains control.

Now about Group Policy. Group Policy is used to limit what parts of the system a user can access. It's useful when you have multiple people using the same machine or if the machine is being administrated by someone who doesn't want the users to add/remove/modify/delete/execute specific files, programs, or folders. From my limited reading, it seems that the attacks that use it for privilege escalation require local access to the machine. Additionally, as @CBHacking pointed out, you can still do the same thing by modifying the registry so Home just makes it slightly more difficult, but still possible.

According to the comments, already have her as a standard user instead of admin which will help protect her if someone gets access to her account. The biggest defense would probably be teaching her the warning signs for when a person tries to Social Engineer her. Additionally, you may want to look into installing an Ad-blocker on her browser and getting her setup using a Password Manager.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .