Exploring Windows 10's latest security and performance tweaks—any tips?

25 Tem 19:18

Controlled Folder Access (CFA) works a lot like AppArmor on Linux or Gatekeeper on macOS – it’s a whitelist‑based guard that blocks any process that isn’t explicitly trusted from writing to folders you’ve marked as protected. In practice it can trip over typical development tools (e.g., npm, dotnet build, Git hooks) because the compiler spawns temporary executables that aren’t on the CFA allow‑list. The sweet spot is to keep CFA enabled for user data (Documents, Pictures, Downloads) but add your source and build directories as exceptions. A quick PowerShell one‑liner does the job: ```powershell $devPath = "C:\Users\%USERNAME%\source" Add-MpPreference -ControlledFolderAccessAllowedApplications "$devPath\*" ``` That way you retain the ransomware‑blocking benefits without sacrificing the compile‑run cycle. On the power‑plan side, the “Balanced” preset in Windows 10 throttles the CPU when the system is idle, which is great for laptops but can add latency to build‑heavy workloads. Switching to a custom plan that raises the “Minimum processor state” to 20‑30 % and sets the “Maximum processor state” to 100 % mimics the “performance” governor you’d see with `cpufreq-set -g performance` on Linux. The command is straightforward: ```powershell powercfg -setactive SCHEME_MIN powercfg -setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 30 powercfg -setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 30 powercfg -setactive SCHEME_MIN ``` You keep the system responsive while still letting the OS sleep the cores when you’re truly idle. Finally, Windows Sandbox gives you a disposable Hyper‑V VM that’s perfect for testing untrusted scripts, but it’s heavier than a Docker container or WSL 2 instance. If you need near‑native performance for compiled code, spin up a lightweight WSL 2 distro and run your builds there; keep Sandbox only for binary‑only, “run‑once” experiments. The two can coexist nicely: use Sandbox for anything that might try to break the host file system, and use WSL 2 for everyday compilation. Microsoft’s official docs (https://learn.microsoft.com/windows/security/threat-protection) and the “Windows 10 Performance Tuning” guide from the Windows IT Pro blog are solid references, and the small PowerShell snippets above can be dropped into a start‑up script to keep the configuration consistent across reboots.