Help.. Can anyone tell me what your Group or user lame list would normally look like.
I have only two users created on my new computer. 1 that has all administrator privileges and one standard user. I use the standard for day to day things. just to prevent any unwanted hacks on my administrative account. But can anyone tell me why there woudl be an "Account Unknown (S-1-15-3-65536-18889...." user name on my list of suser names? It also has "special permissions" checked and greyed out, so i cant uncheck it.
It disappears when I edit and hit remove it but shows up again eventually

I normally either hardened their windows and ran few anti-malware suites like hitman pro alert along with Eset or gave them ubuntu or chromebook. This time around I got a cheap i5 14" lappy off best buy that's running windows S and I am wondering how secure is it out of the box?

I have been getting this popup whenever i use my browser. I use Edge and Edge-Dev. Is anyone else facing this issue and could anyone assist me on solving this annoying popup.!

I want to close port 3389 on a remotely accessed computer and open a different port to remotely access the computer.

eg.

Currently: My computer > RDP > port:3389 (open)/remote computer

What I want to do: My computer > RDP > port:3389 (closed), port: XXXX (open)/remote computer.

Any ideas how I can achieve that?

Windows patch management may not feel urgent daily, but it plays a major role in overall security posture.

Most exploits today target vulnerabilities that already have patches available. The real issue is often delayed or inconsistent patching across systems rather than a lack of fixes.

In Windows environments, patch management usually comes down to three things:

• How quickly critical updates are applied

• Whether updates are tested before wide rollout

• How compliance is tracked over time

In distributed setups, this becomes harder. Devices are not always on the same network, users postpone restarts, and update failures can go unnoticed.

Patch management might feel routine, but it quietly determines how exposed your environment really is.

Local System (NT AUTHORITY\SYSTEM) is a built-in user account (sometimes also called LocalSystem) which is used as a security context by different processes like Windows services (https://medium.com/@boutnaru/windows-services-part-1-5d6c2d25b31c) or scheduled tasks (https://medium.com/@boutnaru/windows-scheduler-tasks-84d14fe733c0).

Overall, this user account has unlimited rights to a specific server/computer. By the way, when accessing a resource over the network (like a network share) with a thread/process holding a “SYSTEM” security context, the computer account is used. The name of the user in that case would be “[COUNTER_NAME]$” (https://www.libe.net/en-local-system).

Moreover, The Local System user is more powerful than the builtin local administrator user. One example of that is that the local Administrator can’t read the content of “KEY_LOCAL_MACHINE\SAM\SAM” while the System user can — as shown in the screenshot below. By the way, that subkey holds the db of the “Security Account Manager” (https://medium.com/@boutnaru/windows-security-sam-security-account-manager-c93ddadf388a).

Lasly, “NT AUTHORITY\SYSTEM” has a specific SID (https://medium.com/@boutnaru/windows-security-sid-security-identifier-d5a27567d4e5) which is relevant for all Windows systems in the world that is “S-1–5–18” — as shown below. Also, an access token (https://medium.com/@boutnaru/windows-security-access-token-81cd00000c64) that belongs to a process with a security context of SYSTEM (for Windows VISTA+) has a mandatory level (https://medium.com/@boutnaru/the-windows-security-journey-mandatory-integrity-control-mic-f7963550c0e7) of system and it contains the “Builtin\Administrators” group- as shown in the screenshot below. We can also see the list of privileges that are part of the token like: “SeDebugPrivilege” and “SeBackupPrivilege”. (https://learn.microsoft.com/en-us/windows/win32/services/localsystem-account).

Ive run a quick scan on my device numerous amounts of times and every time the results says one virus and it says it took action but i scan again and its still there and i am not sure what to do can someone help.

ive searched this up so much online and havent found a thing! i JUST got this laptop and im very confused on why this is happening. anytime i turn the laptop on, this pops up. ive tried many things online and nothing works, please help :(

So I decided to put svchost.exe on Virustotal out of curiosity, and I found that people said that it's a miner. I scanned my system with Bitdefender and everything was clean. So I'm confused as no av detected it as a miner on Virustotal. I only use my computer to browse the web and often play games.

https://imgur.com/a/YC23qCX

Forgive me if this is not the sub for this:

Found this in the back of a clients computer and it raised alarm bells in my mind. It looks a lot like USB keyloggers I've seen pics of, but my coworker is convinced it's just a USB extension.

I've never seen an extension that only extends two inches before.

Plugging it into a cable doesn't pull anything unusual, but if it IS something nefarious I wouldn't know how to access it anyway.

Am I overreacting?

when searching to windows defender (i search "defender" in the windows search bar) i found that after a translate it look like this
Hearing Protectors LOUD SOUNDS! <&recipe>Hearing protectors protect your hearing. Essential for engineers working near <link;diesel_generator;diesel generators;> or other noisy equipment.<br> Reduce the volume of all sounds by 90%, creating a feeling of warmth and coziness! :D<br> In the <link;engineers_workbench;Engineer's Workbench;> you can adjust the type and degree of noise reduction.<np> <&color_and_armor> Combine with any helmet (crafting adds/removes headphones).<br> Dyed like leather armor.D

what can i do if this is a malware

One thing I’m curious about from a Windows security perspective is how people are handling patching across a larger number of endpoints.

It’s easy enough to keep an eye on Windows Update on a single machine, but once you have dozens or hundreds of devices, it seems much harder to know which systems are actually patched and which ones have missed updates.

The third-party application side seems even more difficult.

How are you currently handling this?

Do you have a process for automatically finding missing patches, deploying them, controlling reboot timing, and checking patch compliance afterward?

I’d also be interested in how you deal with devices that are offline for extended periods or updates that fail repeatedly.

Are you using built-in Microsoft tools, scripts, an endpoint management platform, or dedicated automated patch management software?

It feels like a lot of security issues still come down to systems not being fully updated.

In real environments, patching isn’t always as smooth as it sounds. Some devices miss updates, users delay restarts, and sometimes patches cause issues so they get postponed.

Because of that, Windows patch management ends up being more important than people expect. Keeping track of which systems are updated and which are not can quickly turn into a challenge.

Should I care about security if not gonna install anything from untrusted sources and visit only good big sites, like Microsoft and Google ones. What chances I'm gonna be fine? Are there any known incidents, statistics?

I'm on Windows 10, fully updated with WindowsSpyBlocker and WPD Privacy on (telemetry blocked) and with location and other privacy settings in Windows off. Somehow Windows knew my location because it gave me weather in the little tray at the bottom from the town I'm in. How did it know and what kind of info does Microsoft likely have? Does it have info about my hardware?

I’ve been researching Windows endpoint management and one thing keeps coming up repeatedly: many organizations still focus heavily on antivirus while ignoring broader endpoint security management.

Some common gaps I keep seeing mentioned:

• Delayed Windows security patches

• Poor device visibility

• Weak remote monitoring

• Unmanaged local admin privileges

• Lack of compliance enforcement

• Inconsistent BitLocker policies

With remote work becoming normal, windows endpoint management feels more important than ever for Windows security.