To continue running Windows 10 after Microsoft drops support,
1. don't use the system to maintain financial information, or any information that could facilitate identify theft
2. use a quality router with a bult-in firewall, and close all unnecessary ports
3. use a secure DNS, e.g. CloudFlare's free 1.1.1.1
https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/
4. maintain an up-to-date version of MalwareBytes, and direct it to scan for malware once each week?
Detailed recommendations from Perplexity are appended below
? ? ? ?73,
? ? ? ? ? ? Dave, AA6YQ
**Security Precautions for Unsupported Windows 10 PCs**
?
**1. Use a Robust Anti-Malware Solution** ?
Install a reputable third-party antivirus with active updates (e.g., Malwarebytes, Kaspersky) to compensate for the lack of Microsoft security patches. **Microsoft Defender will no longer receive updates after October 14, 2025**, leaving inherent vulnerabilities unpatched[2][4]. Avoid running multiple antivirus programs simultaneously to prevent system instability[3].
?
**2. Enable Advanced Browser Protections** ?
Use browsers like **Firefox** or **Microsoft Edge** with strict pop-up blockers, ad-blockers (e.g., uBlock Origin), and enable **SmartScreen** to block malicious sites[3]. Avoid downloading untrusted files or opening suspicious email attachments[3].
?
**3. Apply Third-Party Security Patches** ?
Services like **0patch** offer micro-patches for critical vulnerabilities. The free tier covers some 0-day exploits, while the Pro plan ($24.95/year per PC) provides comprehensive coverage[4]. This is essential for mitigating unpatched Windows vulnerabilities.
?
**4. Minimize Attack Surface** ?
- **Disable unnecessary services/ports** - seen report appended below
- **Use a standard (non-admin) account** for daily tasks to limit malware privileges[3]. ?
- **Enable Tamper Protection** in Windows Security to prevent unauthorized changes to security settings[3].
?
**5. Network-Level Protections** ?
- **Use a firewall** (hardware or software) to restrict inbound/outbound traffic. ?
- **Route traffic through a secure DNS** (e.g., Cloudflare 1.1.1.1) to block malicious domains. ?
- **Consider isolating the PC** from critical network devices using VLANs or a separate physical network.
?
**Critical Reminder:** ?
Unsupported systems remain vulnerable to **zero-day exploits** and targeted attacks. Use this PC only for non-sensitive tasks, and avoid storing critical data or accessing financial accounts from it[2][4].
Citations:
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
?
**Ports to Consider Closing in Windows 10 for Enhanced Security**
**Critical Ports to Block** ?
- **Ports 135-139, 445**: Associated with SMB (Server Message Block) and NetBIOS, historically targeted for exploits like EternalBlue. **Disable SMBv1** first via "Turn Windows Features On/Off," then block these ports if no network sharing or printing is needed[4][5]. ?
- **Port 3389**: Used for Remote Desktop Protocol (RDP). Block inbound connections unless remote access is explicitly required[4][7]. ?
- **Ports 1433/1434**: Used by Microsoft SQL Server. Close if no database services are running[4][7]. ?
- **Port 3306**: MySQL default port. Unnecessary unless hosting a MySQL server[4][7]. ?
- **Port 5000**: Often used by vulnerable services (e.g., Universal Plug and Play). Block unless required[5]. ?
**General Guidelines** ?
1. **Identify Open Ports**: Use `netstat -an` to detect listening ports[7][5]. ?
2. **Block via Windows Firewall**: ?
? ?- Navigate to **Windows Defender Firewall > Advanced Settings > Inbound Rules > New Rule**[2][3]. ?
? ?- Select **Port > Block Connection** and specify the port number (e.g., 445)[3][5]. ?
3. **Outbound vs. Inbound**: ?
? ?- **Inbound**: Block unused services (e.g., RDP, SMB). ?
? ?- **Outbound**: Generally safe to leave open unless restricting telemetry/data exfiltration[4][6]. ?
**Impact of Closing Ports** ?
- **SMB/NetBIOS**: Disables file/print sharing and network discovery[4][5]. ?
- **RDP**: Prevents remote access but has no effect on local use[4]. ?
- **Database Ports**: Stops external access to SQL/MySQL services[4][7]. ?
**Security Best Practices** ?
- **Disable Unused Services**: Turn off SMBv1 and RDP in Windows Features/Settings[4][5]. ?
- **Use a Router Firewall**: Block inbound ports at the network level (e.g., disable UPnP)[5][7]. ?
- **Minimal Rule Set**: Allow only ports 80 (HTTP), 443 (HTTPS), and specific application ports (e.g., SSH on 22 if used)[6][7]. ?
**Tools for Management** ?
- **Windows Firewall**: Primary tool for port blocking[2][3][8]. ?
- **Third-Party Software**: Tools like Windows Doors Cleaner simplify port management but are less transparent[5]. ?
?
Citations:
[1]
[2]
[3]
[4]
?
[5]
[6]
[7]
[8]
?
Answer from Perplexity: pplx.ai/share
?
