===Windows 7 Special -- Defaulting===

===Windows 7 Special -- Defaulting===

Non-profit and free for redistribution
Written on January 3rd | 2018
Published on January 3rd | 2018

For entertainment and research purposes only
++++++++++++++++++++++++++++++++++++++++++++++++++++

DISCLAIMER
The Paranoid's Bible and its writers hold no responsibility for the acts of others.

The Paranoid’s Bible is for research and entertainment purposes only.

Please visit our blog for more PDFs and information: http://www.paranoidsbible.tumblr.com/
++++++++++++++++++++++++++++++++++++++++++++++++++++

===Preface===
Once you've finished the initial installation of 7, you should come to the desktop after it logs in or requests you to login. From here on out, we’ll work on doing the act of "Defaulting," which is where the end-user, while offline and NOT on any networks, uses nothing more than what is provided with the OS to configure, tweak and adjust settings (I.E: Setting things to your preferred defaults, or in this case for maximum security and privacy).

The reasoning for this is, while we're offline, we can avoid a lot of common mishaps and problems, like the system becoming compromised before doing any real security or configuring. The other reasoning for this is to lessen distractions and help you concentrate on the task at hand: Creating a clean environment for you to use.

So, before we begin, we wish to remind you to take breaks while doing this. We'll make notes of where you should take a break, however if you feel overwhelmed at any point in this guide... then, yes, take a break and come back to working on it. It's good practice to be patient and to take breaks when working on any operating system as it'll help you prevent mistakes and leaving any glaring holes in place.

===REMEMBER===: You'll not be installing any drivers or programs, yet. This is so it's easier for you to adjust and control your system.
++++++++++++++++++++++++++++++++++++++++++++++++++++

===Starting off Small===

Now, before we begin, have your USB ready for we’ll make a backup of our registry and do some minor tweaking before we do anything else.
> Start Button
> Type in “Regedit” and hit enter
> In Regedit, select the “File” menu
> Then select “Export” and save that file to your USB.
> You’ve now backed up your registry

- --Disable User assist logs--
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\UserAssist\
> Look for the two sub-keys called "Count"
> Delete both of thesesub- keys
> Now right-click on the “userassist” key
> Scroll down to the “New” submenu
> Create a new folder/key named "Settings"
> In the “Settings” folder/key create a new DWORD value
> Name this new DWORD "NoLog" and set value to 1
> Windows should no longer store logs on your activity

--- Unload DLLs---
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
> In the “Explorer” folder/key
> Right-click and create a new DWORD
> Name it "AlwaysUnloadDLL" and set its value to 1

- --Tweaking NTFS to prevent some leaks---
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem
> In the “Filesystem” folder/key
> Right-click and create a new DWORD
> Name it "NtfsDisable8dot3NameCreation" and set it to 1
--- Disable records, time and dates.---
> In the “Filesystem” folder/key
> Right-click and create a new DWORD
> Name it  NtfsDisableLastAccessUpdate and set it to 1

Exit out of the registry and proceed below.

Now click:
Start > Control Panel > System and Security > Administrative Tools > Computer Management

Once inside:
Computer Management > Performance > Data Collector Sets > Startup Event Trace Sessions

In this area, double click each item and set it to disable, which can be done by going to the “Trace Session” tab in the properties window that pops up and uncheck/disable the “Enable” option. From here, just hit apply and OK.

After the above, we’ll start small and work our way up. The first step here is to right-click your taskbar and select properties.

> Right-click taskbar
> Select "Properties" from the menu that appears
> Un-tick/disable "Lock the taskbar"
> Tick/enable "Auto-hide the taskbar"
> Tick/enable "Use small icons"
> Taskbar location is up to you
> Taskbar buttons should be set to "Never Combine"
> For Notification area, you'll have to set it to what you want

Move onto the "Start Menu" tab.
> Start Menu tab
> Customization is up to you
> Same applies to the "Power button action"
> Un-tick/disable "Store and display recently opened programs in the Start menu"
> Un-tick/disable "Store and display recently opened items in the Start menu and taskbar"

Moving to the "Toolbar" menu
> Disable/un-tick everything here

The reasoning for the above is that you just removed some of the most commonly intrusive items that can be used by the forensic analysts, besides that you've reclaimed some resources and space that can be better used. While not optimized for the user, and could potentially cause some extra-clicks in the end, you did help lessen some potential issues besides making things look a little neater.

Now right-click the desktop and select "Personalize" from the menu that appears, do the following…
> Personalization window appears
> Click the "background" link from below
> Select "Solid colors" from the drop-down menu in the windows that appears
> Choose a color you wish to use
> Click "OK"
> In the same window from the beginning
> Click the "Sound" link
> In the window that appears, select "No sound" from the drop down
> Click "Apply" and then "OK"
> Click the "Change desktop icons" link on the upper most left of the "personalization" window
> Adjust as you see fit, ensure "Allow themes to change desktop icons" is un-ticked/disabled
> Click "OK" to return to the original window
> Click "Change mouse pointers" link
> Adjust how you see fit, however in the "Pointers Options" tab disable/un-tick the "Enhance pointer precision" option
> In the "Pointers" tab, ensure you've disabled/un-ticked the "Allow themes to change mouse pointers" option
> Click "Apply" and then "OK"
> Exit out of the personalization window

The above saved you some resources and helped cut down on some annoyances you might experience down the line. It also helps us make the system look less appealing to shoulder surfers and nosey individuals. Doesn't matter, we all know one person who'd sit and watch over our shoulders; ergo this will help keep them uninterested to some extent.

Right-click the "My computer" icon on the desktop and select "Properties" from the menu that appears…
> Click the "Advanced system settings" link
> In the "Advanced" tab, click the "Performance" tab
> In the "Visual Effects" tab, tick/select the "Adjust for best performance" option and click "Apply"
> Click the "Advanced" tab and click the "Change" button in the "Virtual memory" section
> Un-tick/disable "Automatically manage paging file size for all drives"
> Tick/enable the "No paging file" option and then click the "Set" button.
> Click the "OK" button and then the "Apply" button. DO NOT RESTART YET
> Click the "OK" button again to return to the "System Properties" window
> Still on the "Advanced" tab, click the "Settings" button in Startup and Recovery
> Now un-tick/disable "Write an event to the system log" and "Automatically restart"
> Set "Debugging Information" to "None"
> Click the "OK" button again to return to the "System Properties" window
> In the "System Protection" tab, click the "Configure" button
> In the window that appears, tick/enable "Turn off system protection" option
> Adjust the slider to "0 bytes"
> Then click the "Delete' button to clear any backups/restore points made
> Hit "Apply" and then the "OK" button to return
> In the "Remote" tab, un-tick/disable "Allow Remote Assistance connections to this computer"
> Tick/enable "Don't allow connections to this computer"
> Click "Apply" and then "OK".

The reasoning for the above is to reclaim resources, prevent some of the most commonly targeted areas/features the forensic analysts dig into, and to basically help prevent traces from being made.

You may now restart your computer, however we recommend that at this point you take a few minutes for a break and decompress a bit before continuing. The reason for this, as stated previously, is to prevent you from feeling overwhelmed. Get up, take a walk around your room or house, get something to drink and stretch before continuing.

=====================================================================================
					TAKE A BREAK HERE
=====================================================================================

===Defaulting, Continued===

Once you've taken your break and restarted your computer, click the "Start" button.
> Start button
> Click the "Control Panel" button
> "View by" drop down menu, select "large icons" for easier navigation
> Click the "User Actions" icon
> Navigate to the "Change User Account Control settings" link and click it
> Adjust slider to the way bottom/"Never notify" and click "OK"
> Return to control panel

We've disabled some of the pesky alerts and allowed ourselves to do more without being sidetracked by pop-ups every few seconds.

Go ahead and click the "Action Center" icon.
> Action Center
> Click the "Customer Experience Improvement Program settings" link
> Ensure "No, I don't want to participate in the program" is selected
> Click the "Problem reporting settings" and ensure "Never check for solutions" is selected
> On the main window of the "Action center" settings, ensure you've un-ticked/disabled all options there.
> Click "OK
> Return to "Control Panel"

You've cut down on some of the info spreading behavior that's trademarked to Microsoft, besides disabling some logs used by forensic analysts.

Ignore "Administrative tools" for now and click the "AutoPlay" icon.
> In the "AutoPlay" window
> Un-tick/disable "Use Autoplay for all media and devices"
> Set everything to "Take no action"

Prevents autoplay, which means you've prevented some obvious tactics used by people to try and spread malicious content to your computer.

Ignore "Backup and Restore," move directly to "Bitlocker Drive Encryption". Here you'll just want to ensure everything is disabled/set to off. You'll be using a better 3rd party encryption later on in this series of guides.

Ignore and skip the below areas:
- "Color management" (unless you've some sort of preference you wish to use)
- "Credential Manager", "Date and Time" (skip for now)
- "Default Programs" (unless you've a specific preference)
- "Desktop Gadgets" (Will be removed later as it's useless and a waste)
- "Device Manager" (skip for now)
- "Devices and Printers" (skip for now)
- "Display" (unless you've a specific preference)

Click the "Ease of Access" icon and ignore everything there, save for the two settings "Always read this section aloud" & "Always scan this section". You'll want to un-tick/disable those two settings to prevent any potential issues in the future.

Moving onto "Folder Options, click its icon…
> Folder Options
> "General tab"
> Up to you, however un-tick/disable the bottom two options
> "Show all folders" & "Automatically expand to current folder" should be disabled/un-ticked
> "View" tab, tick/enable only the below items
- Always show icons, never thumbnails (prevents thumbnail caching)
- Display the full path in the title bar (easier to navigate and make note of where things are)
- Don't show hidden folders or drives (you can change this as needed)
- Hide empty drives in the Computer folder (you can change this as needed)
- Hide extensions for known file types (you can change this as needed)
- Hide protected operating system files (you can change this as needed)
- Show drive letters
- Show encrypted or compressed NTFS files in color
- Show pop-up description for folder and desktop items

==Remember==: If it wasn't listed in the above for "Folder options," then we don't recommend it, however if you feel you need it then that's up you. We can't guarantee anything outside of our own knowledge.

> Still in "Folder Options"
> "Search" tab
> Enable/tick "Always search for file names and contents"
> Enable/tick only the below settings
- Include subfolders in search results when searching in file folders
- Find partial matches
- Don't use the index when searching in file folders for system files
- Include system directories
- Include compressed files

==Remember==: If it wasn't listed in the above for "Folder options," then we don't recommend it, however if you feel you need it then that's up you. We can't guarantee anything outside of our own knowledge.

Ignore and skip the below areas:
- Fonts (unless you need to add or remove. Remember more fonts = distinguishable systems)
- Getting Started

Click the "Home Group" icon.
> Click the "Change advanced sharing settings..."
> Tick/enable all three of the "Turn off" settings
- Turn off Network discovery
- Turn off file and printer sharing
- Turn off Public folder sharing
> Still on the same the window, ensure the below settings are selected/enabled
- Use 128-bit encryption to help protect file sharing connections
- Turn on password protected sharing
> Click save changes and return to Control Panel

Click the "Indexing Options" icon.
> Click the "Modify" button
> Click the "Show all locations" button
> Check/click the box next to your "local disk" and then click the box again to uncheck everything
> Repeat the above step with offline file
> Double click "Start Menu" to see if anything appears, if not, you most likely disabled/unchecked all locations for indexing
> Click OK" and then click "Close"
> Return to Control Panel

Ignore and skip the below areas:
- Keyboard (unless you've a specific preference)
- Location and Other Sensors (for now)
- Mouse (unless you've a specific preference)

Click the "Network and Sharing Center" icon
===Note===: Under “View your active networks,” if you see something like “Network 1” or similar, ensure it’s set to “Public Network” just to make sure some settings are semi-hardcoded. Always set your network as if it's a "Public Network" just to tighten things up a bit.

> Click the "Change adapter settings" link
> Double click your Local Area Connection icon
> Ensure only these three settings are enabled
- Client for Microsoft Networks (for Windows update, will disable later)
- Internet Protocol Version 4 (Enable IPV 6 only if you need it)
- Link-Layer Topology Discovery Mapper I/O Driver
> Click "Okay" and return to Control Panel

Ignore and skip the below areas:
- Notification Area Icons (unless you've a specific preference)
- Parental Controls
- Performance Information and Tools
- Personalization (unless you've a specific preference)
- Phone and Modem

Click the "Power Options" icon
> Click the "Hide additional plans" menu
> Tick/enable "High performance" and then click "Change plan settings"
> Set "Turn of display" to whatever you want
> Click the "Change advanced power settings" link
- High Performance > Require a password on wake > Yes
- Hard disk > Turn off hard disk after > Whatever you wish
- Desktop background settings > Slide show > Set to "pause"
- Wireless adapter settings > Power saving mode > set to maximum power saving (Shouldn't have wireless on a desktop anyways)
- Sleep > Hibernate after > Never
- Sleep > Allow wake timers > Disable
- USB settings > Whatever you want
- Power buttons and lid > Set to "Shutdown"
- PCI Express > Whatever you want
- Processor power management > Whatever you want
- Display > Whatever you want
- Multimedia settings > Whatever you want
- Internet Explorer > Whatever you want
> Click "Apply" and then "OK"
> Return to the Control Panel

Ignore and skip the below areas:
- Programs and Features (for now)
- Recovery
- Region and Language (unless you've a specific preference)
- RemoteApp and Desktop Connections
- Sound (unless you've a specific preference)
- Speech Recognition (unless you've a specific preference)
- Sync Center
- System (for now)
- Taskbar and Start Menu (unless you've a specific preference)

Click the "Troubleshooting" icon
> In Troubleshooting click "No" for whether or not you want to use the "updated" help files or to download them
> Click the "Change settings" link to the left
> Enable/tick the below
- Off
> All others should be disabled/un-ticked
> Click "OK"
> Return to Control Panel

Ignore and skip the below areas:
- User Accounts
- Windows CardSpace
- Windows Defender (will be deleting)
- Windows Firewall (Will be using a better 3rd party firewall)
- Windows Update (for now)

We've now reclaimed some more resources, disabled some annoyances and prevented some areas from being used against us by forensic nerds. You've also further strengthened your system. Now restart your system once again.

=====================================================================================
					TAKE A BREAK HERE
=====================================================================================

===Taking Inventory===

Once we've taken our break and the computer has restarted, and before we do anything else... we're going to "Take inventory," which means we're going to familiarize ourselves a bit with our file system. This is a simple step and is more aimed at helping you rely on yourself more so than any program that exists.

You start off simply by going to "My computer' and then selecting the hard disk (Will be referred to as HD from now on) the OS is installed on and looking at your root directory. What's there? You should see folders similar to the below:
- C:\PerfLogs
- C:\Program Files
- C:\Program Files (x86)
- C:\Users
- C:\Windows

===Note===: C:\ is default, so whatever your HD's letter's set to.

Each of these will contain sub-folders and file, and those sub-folders will have sub-folders and files and so on and so forth. You don't have to make a note of everything there, however keep a .txt saved on a USB. This will serve as a loose journal on what folders exist and where. You just want the main folders listed, and possibly any sub-folders that standout to you. This way when you clean, check around or simply wish to browse you can make note of any changes that were made of any new files and/or folders created.

By doing this, you are basically ensuring nothing has been added without your knowledge. This is quite useful when uninstalled programs, especially games. A lot of programs will create folders and sub-folders that don't necessarily seem related to said program. So, for example, you installed a game from Steam which created a sub-folder called "Gitsgeneral" that isn't even close sounding like anything related to this game. Once you've uninstalled this game, "Gitsgeneral" still exists and you're unsure whether or not it’s safe to delete because you don't know what it's related to or even if it's something you put there.

This is why you should take the extra time to familiarize yourself to what folders exists and where on your system, especially in area like C:\Users\Your username here\AppData. There's a ton of folders that get stranded in Appdata, things like leftovers from games or programs you were testing out. So, yes, while a bit time consuming and annoying, make a general note and saving it on a secure USB, you'll be able to keep tabs on what created what and where. This is especially useful when you're manually cleaning traces during one of your monthly nuclear cleans.

Once done, take a break before moving onto the next chapter.

=====================================================================================
					TAKE A BREAK HERE
=====================================================================================

===Removing some bloat===

Every system has bloat, and unless you've gotten your hands on an OEM disk or a clean pirated copy of 7, you're going have to deal with uninstalling these items and removing any leftovers by hand. This is why we recommend you "Take inventory". Now, to began, simply click "Start" and then "All programs". Here you'll delete, by hand, any shortcuts you don't need or want (This won't delete this programs). You may get lucky, too, and find a handful of uninstall shortcuts to remove any programs you don't want or like.

From here, hit the Control Panel and finally click the "Programs and Features" icon. You'll get a bunch of folders and program names. We'll remove some items that are useless and/or pose a security and/or privacy risk. Below will be a list of things to remove (I.E: Un-tick/uncheck/disable):

- Games (Useless, can download free games or get games on any number of platforms)
- Indexing services (Useless, info that can be used by forensic nerds)
- Internet Information Services (useless)
- Internet Information Services Hostable Web Core (useless)
> Media Features, remove only...
- Windows DVD Maker (Useless, better 3rd party programs exist)
- Windows Media Center (useless)
> Leave Windows Media Player alone (needed for some games and software)
> Microsoft .NET Framework (numbers)
- Disable everything that exists as a sub, leaving the main alone (should see a grayed out checkmark then)
Example: Microsoft .NET Framework 3.5.1 is left alone, but the subs Windows Communication Foundation HTTP Activation & Windows Communication Foundation NonHTTP Activation are disabled/unticked
- Microsoft Message Queue (MSMQ) Server
> Print and Document Services (remove completely unless needed)
> If needed, similar to the Microsoft .NET settings, disable everything and ensure it has a grayed out checkmark
- RIP listener
- Services for NFS
- Simple Network Management Protocol (SNMP)
- Simple TCIP services (i.e. echo, daytime etc)
- Subsystem for UNIX-based applications
- Tablet PC Components
- Telnet Client
- Telnet Server
- TFTP Client
- Windows Gadget Platform
- Windows Process Activation Service
- Windows TIFF IFilter

Now click the "OK" button, however don't restart your computer just yet (Click the "Restart Later" button). Double check the installed programs and make a note of what's installed. Remove anything you don't want or need, as fewer programs equate less potential problems.

You've just removed a bunch of junk and space wasters besides preventing the forensic nerds from using some items against you. Before we end this chapter, however, go to your personal folder (E.G: Your username) and do the following:
- Contacts folder > Delete card/contact info
- Favorites Folder > Delete the two sub-folders
- Links > Delete the useless (three) items there
- Delete the sample/demos in My Pictures & My Music & My Videos

You may now restart your computer once you've ensured you've uninstalled and removed anything you don't want or need.

===NOTE===: Don't bother emptying your recycling bin, just yet.

=====================================================================================
					TAKE A BREAK HERE
=====================================================================================

===Preparing for the Next Guide===

As we near the completion of this guide, we'll be installing some programs. Not a lot, just enough to sanitize, clean and adjust the system. The next guide will address settings, registry edits and some manual cleaning before we install our programs and drivers. So, please, remember, take a break if you feel overwhelmed, and to also be patient.

Right click your desktop and make a new folder called "Maintenance". Double click and place the below files into it:
- Ancile
- Black Bird
- DWS_Lite
- GWX_control_panel
- Icon Cache Flush
- Run as system
- USB Oblivion
- Windows Privacy Tweaker

Unpack each program to their own folders and ensure they're located in the maintenance fold you've created. Open up "Ancile" and copy the folder in there to your desktop. Rename this folder to just "Ancile". Open up the Ancile folder and click the Ancile bat. Follow the prompts given. Let it run and do its thing, this will remove and cleanup a whole mess of loose ends. It'll also prevent Windows 10 from being forced onto your system.

Once it's finished, you can remove the folder from the desktop VIA deleting it.

Repeat the above with Black bird. You can remove the folder VIA deleting.

Go back to maintenance and double-click DWS_Lite. *Redundant*
> DWS_Lite
> "Settings" tab
> Tick/enable the "Enable professional mode" setting and ensure everything's checked
> Go to the "Utilities" tab
> Click "Delete all Windws 10 metro apps"
> Click "Delete one drive"
> Click "Disable UAC"
> Click "Remove all old DWS firewall rules"
> Go to the "Main" tab
> Click "Destroy Windows 7/8.1 Spying" button

Go back to maintenance and double-click GWX_control_panel. *Semi-redundant*
> Click the "Delete windows 10 download folders..." button
> Click "Clear Windows Update Cache"
> Exit GWX_control_panel.

Go back to maintenance and double-click Windows Privacy Tweaker. *Semi-redundant*
> Go to "Services" tab and then click "Uncheck all"
> Go to "Scheduler" and then click "Uncheck all"
> Go to "Registry" and then click "Uncheck all"
> Click exit and then click the "No, later!" option

Go back to maintenance and double-click Icon Cache Cleaner/Rebuilder bat, follow on screen prompts.

Go back to maintenance and double-click USB Oblivion, uncheck "Save backup .reg-file," then check "Do real clean". Click the "Clean" button and run it twice. Exit it and you can now restart your computer.

Before moving onto the next chapter, please go to C:\Windows\System32\winevt\Logs and remove all event logs from there. The logs should have the extensions of *.evt and *.evtx (Should state “Event Log” as type).

The reason for their removal is simple: Less information to be leaked.

Now, go to Control Panel > Administrative Tools > Click “Services”.

Wait for the window to pop-up, once it has
> Click the “Startup Type” tab
> Ensure it sorts so “Automatic” is clustered at the top
> Find “Windows Event Log” and double-click it
> Set it to “Disable” and click “Apply” then “OK”
> Repeat the above with “Windows Event Collector”

Restart your system so settings take effect.
++++++++++++++++++++++++++++++++++++++++

===Afterword===

What you've just done is wholly overlooked by many computer users. While note completely foiling the forensic nerds, you did just make their job a bit harder by taking care of some overlooked areas. While some are seen as placebos or being redundant, you did ensure certain logs and traces won't be made now. So, once you get into the next guide in this series... things will be just that easier.