Realizing that Microsoft is threatening stoping support for Windows 10
this year, I am thinking about biting the bullet and getting it over
with and starting the learning and mental adaptation to it.

I am looking for advice from those who have already gone down this path,
and opinions as well.

For our Gurus, your advice and recommendations would be greatly appreciated.

I admit some concerns about trying an "upgrade in place" as opposed to a
fresh install.

I am also considering a newer desktop, though according to Dell and
Microsoft, the current machine should be adequate for my needs.

Your advice is appreciated.

Thanks and 73 de Dave, W5SV

To continue running Windows 10 after Microsoft drops support,

1. don't use the system to maintain financial information, or any information that could facilitate identify theft

2. use a quality router with a bult-in firewall, and close all unnecessary ports

3. use a secure DNS, e.g. CloudFlare's free 1.1.1.1

https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/

4. maintain an up-to-date version of MalwareBytes, and direct it to scan for malware once each week?

Detailed recommendations from Perplexity are appended below

? ? ? ?73,

? ? ? ? ? ? Dave, AA6YQ

**Security Precautions for Unsupported Windows 10 PCs**

?

**1. Use a Robust Anti-Malware Solution** ?
Install a reputable third-party antivirus with active updates (e.g., Malwarebytes, Kaspersky) to compensate for the lack of Microsoft security patches. **Microsoft Defender will no longer receive updates after October 14, 2025**, leaving inherent vulnerabilities unpatched[2][4]. Avoid running multiple antivirus programs simultaneously to prevent system instability[3].

?

**2. Enable Advanced Browser Protections** ?
Use browsers like **Firefox** or **Microsoft Edge** with strict pop-up blockers, ad-blockers (e.g., uBlock Origin), and enable **SmartScreen** to block malicious sites[3]. Avoid downloading untrusted files or opening suspicious email attachments[3].

?

**3. Apply Third-Party Security Patches** ?
Services like **0patch** offer micro-patches for critical vulnerabilities. The free tier covers some 0-day exploits, while the Pro plan ($24.95/year per PC) provides comprehensive coverage[4]. This is essential for mitigating unpatched Windows vulnerabilities.

?

**4. Minimize Attack Surface** ?
- **Disable unnecessary services/ports** - seen report appended below
- **Use a standard (non-admin) account** for daily tasks to limit malware privileges[3]. ?
- **Enable Tamper Protection** in Windows Security to prevent unauthorized changes to security settings[3].

?

**5. Network-Level Protections** ?
- **Use a firewall** (hardware or software) to restrict inbound/outbound traffic. ?
- **Route traffic through a secure DNS** (e.g., Cloudflare 1.1.1.1) to block malicious domains. ?
- **Consider isolating the PC** from critical network devices using VLANs or a separate physical network.

?

**Critical Reminder:** ?

Unsupported systems remain vulnerable to **zero-day exploits** and targeted attacks. Use this PC only for non-sensitive tasks, and avoid storing critical data or accessing financial accounts from it[2][4].

Citations:

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

?

**Ports to Consider Closing in Windows 10 for Enhanced Security**

**Critical Ports to Block** ?

- **Ports 135-139, 445**: Associated with SMB (Server Message Block) and NetBIOS, historically targeted for exploits like EternalBlue. **Disable SMBv1** first via "Turn Windows Features On/Off," then block these ports if no network sharing or printing is needed[4][5]. ?

- **Port 3389**: Used for Remote Desktop Protocol (RDP). Block inbound connections unless remote access is explicitly required[4][7]. ?

- **Ports 1433/1434**: Used by Microsoft SQL Server. Close if no database services are running[4][7]. ?

- **Port 3306**: MySQL default port. Unnecessary unless hosting a MySQL server[4][7]. ?

- **Port 5000**: Often used by vulnerable services (e.g., Universal Plug and Play). Block unless required[5]. ?

**General Guidelines** ?

1. **Identify Open Ports**: Use `netstat -an` to detect listening ports[7][5]. ?

2. **Block via Windows Firewall**: ?
? ?- Navigate to **Windows Defender Firewall > Advanced Settings > Inbound Rules > New Rule**[2][3]. ?
? ?- Select **Port > Block Connection** and specify the port number (e.g., 445)[3][5]. ?

3. **Outbound vs. Inbound**: ?
? ?- **Inbound**: Block unused services (e.g., RDP, SMB). ?
? ?- **Outbound**: Generally safe to leave open unless restricting telemetry/data exfiltration[4][6]. ?

**Impact of Closing Ports** ?

- **SMB/NetBIOS**: Disables file/print sharing and network discovery[4][5]. ?

- **RDP**: Prevents remote access but has no effect on local use[4]. ?

- **Database Ports**: Stops external access to SQL/MySQL services[4][7]. ?

**Security Best Practices** ?

- **Disable Unused Services**: Turn off SMBv1 and RDP in Windows Features/Settings[4][5]. ?

- **Use a Router Firewall**: Block inbound ports at the network level (e.g., disable UPnP)[5][7]. ?

- **Minimal Rule Set**: Allow only ports 80 (HTTP), 443 (HTTPS), and specific application ports (e.g., SSH on 22 if used)[6][7]. ?

**Tools for Management** ?

- **Windows Firewall**: Primary tool for port blocking[2][3][8]. ?

- **Third-Party Software**: Tools like Windows Doors Cleaner simplify port management but are less transparent[5]. ?

?

Citations:

[1]

[2]

[3]

[4]

?

[5]

[6]

[7]

[8]

?

Answer from Perplexity: pplx.ai/share

?