If someone has SYSTEM rights to my PC remotely security question

BlackVen0m said:

Or that he can basically format my whole non OS drives with a click of a button whenever he likes? "

You can limit SYSTEM on non OS drivers (write/modify), it actually prevents ransomware, which uses SYSTEM.

Firstly, you should only use RDP on a LAN or via a VPN.

You should set secure credentials so a person cannot remote over internet to PC.

You can also turn off RDP when not needed.

For somebody to get access via RDP over internet, you have to set up port forwarding to your pc. Simple thing - Don't!




In the end, for somebody to get access via RDP, your pc has to have already been compromised e.g. via malware previously installed.

I only use apps like Splashtop to access my pc over internet, and make sure passwords etc. are secure. For a hacker to access pc, they need to know passwords etc. You can minimise risk by turning of the host servers when not needed.

As for users having physical access, then use Bitlocker with Bitlocker PIN particularly on laptops outside home environment.

My point is there is lots of common sense (regrettably an oxymoron) things you can do to minimise risk by not letting them get access.

Of course, if one is careless and allows a person access with admin rights, nothing can truly protect you. You can set up all sorts of policies, but they can be reversed.

I never let anybody other than myself have admin rights to my devices.

I use simply expediency of a second pc for vistors and even then, only allow a standard account. If I have any concerns, I just wipe pc and restore from a backup.


So whilst you are right about what damage COULD be done, in reality you can take sensible protection measures to minimise risk.

Of course, regular image backups etc help to protect you (assuming pc is not alreasy compromised).

To me, recognising when pc is compromised is more important than lulling yourself into a false sense of security by assuming all your protective measures are adequate.

In the end, the only way to keep a oc totally secure is to never connect to internet and never allow others to use pc.

Even then, the simple act of installing software can make a device insecure but a person still needs physical access to do any harm.

No one connecting is System that is the windows itself

TairikuOkami said:

You can limit SYSTEM on non OS drivers (write/modify), it actually prevents ransomware, which uses SYSTEM.

Should already be done if a regular Windows distribution user. If insider, see second paragraph.

"

• he Windows Security app is updated separately from the OS and ships out of box. The version with the vulnerable driver blocklist toggle is in the final validation ring and will ship to all customers very soon. Initially, you will be able to view the configuration state only and the toggle will appear grayed out. The ability to turn the toggle on or off will come with a future Windows update.
  
• For Windows Insiders, the option to turn Microsoft's vulnerable driver blocklist on or off using the Windows Security app is grayed out when HVCI, Smart App Control, or S mode is enabled. You must disable HVCI or Smart App Control, or switch the device out of S mode, and restart the device before you can turn off the Microsoft vulnerable driver blocklist."