Category: windows-administration

Disclaimer

This article is for research purposes. If you do this, I will not be held responsible for any license violations that may occur.

Activating

Simply run the following command in a PowerShell window running as Administrator:

irm https://massgrave.dev/get | iex

After an activation Windows appears with options, choose the first option by hitting the 1 key on your keyboard.

Once the activation finishes, you can hit any key to quit, then the 0 key on your keyboard to quit fully.

• Ensure your Windows device is on a supported version, and is always up-to-date.
• Enable BitLocker Encryption on your boot drive.
• You can enable BitLocker by pressing the Windows key, typing Manage BitLocker, and finally hitting Enter on your keyboard.
• Using a computer without BitLocker (especially on a laptop) is a bad idea. If I was to take someone’s Windows laptop right now, I bet that 99% of those people would not be using BitLocker or any other form of encryption. This means I could simply remove the hard drive, put it in my computer, and copy everything stored on it, no passwords required. Use BitLocker.
• Enable BitLocker on your secondary hard drive(s).
• Same reason as the first, but a bit less necessary. That being said, it’s always good to encrypt your stuff. You never know what you might have on it that a nefarious person could find useful.
• Use a password instead of a PIN.
• Never use a Windows PIN. It’s much less secure than a password (assuming what you’re using isn’t completely moronic), and is easier to “guess”, assuming you’re doing what most people do, which is using a notable year or basic patterns/combos.
• Note: Alternatively, you can use Windows Hello, or another form of biometric.
• Use a local account rather than an online account.
• Surprisingly, most do not know that you do not need to be logged in with a Windows account to use OneDrive, or other Microsoft native services. You can simply make an offline account, then login to OneDrive after, making sure to select “allow only Microsoft apps to sign in” upon doing so.
• In addition, this is somewhat of a controversial step, as it also depends on your use case. Assuming you are using a strong password on your local account, you could be more secure than using a Microsoft Account, especially if you are using a PIN to login, or don’t use an authenticator of some sort. Secondly, using a Microsoft Account puts you at risk of a possible Microsoft data breach, though this is unlikely.
• Use a password manager.
• Don’t just depend on browser synching. Use a password manager and make sure you use secure passwords. I would recommend KeePassXC.
• Lock your computer when away using Windows + L.

1. Open Edit group policy.
2. Navigate to the following directory:
• Computer Configuration -> Administrative templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives
3. Open/configure the following setting: Require additional authentication at startup. Note, do not open the one named Require additional authentication at startup (Windows Server 2008 and Windows Vista) unless you are using Windows Server 2008 or Vista.
4. Change the option from Not Configured to Enabled.

If you try encrypting your OS drive without a TPM chip, you’ll now notice you have the option to setup a password or use a drive as a passkey as well.

Create a .bat file with the following file content. Make sure you point to the .vmx file of your VM.

“C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe” -T ws start “Z:\virtual_machine\virtual_machine.vmx” nogui

Move this .bat file to your startup folder at the following location: C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.