When you reach the end of a Windows 10 installation and enter the account creation phase, the operating system recommends (with some emphasis) using a Microsoft solution or creating a traditional offline profile. Those who follow the second route are forced to fill in three mandatory questions as a "recovery system" for the password. The problem is that these questions can backfire if an attacker has enough knowledge. One way to strengthen Windows 10's (already weak) security is to disable the recovery questions, although it's not that simple…
As we mentioned in our article on changing the PIN length in Windows 10, Microsoft offers different login options. One of the most interesting is Windows Hello, since it enables biometric barriers, but you need the right hardware first. If you don't have access to those elements (for example, a webcam or a fingerprint reader), you'll have to rely on more "traditional" mechanisms, and that includes security questions in the background. In case you forget your main password, Windows 10 will let you sign in and make the relevant adjustments. However, security questions are a double-edged sword (an attacker with elevated privileges can create a permanent backdoor with them). A good recommendation is to ignore the question-answer structure and close that path using "garbage answers" generated with a password manager, but the ideal is to disable the recovery questions directly.
How to disable recovery questions
That's where researchers Magal Baz and Tom Sela from Illusive Networks come in. They created a PowerShell-compatible script that disables the questions at the root. The first step is to download a copy of the script hosted on GitHub. If you click on the file, you can see the entire content, but since there's nothing in the Releases section, you'll need to use the Clone or Download button and download the zip. Then place the script in a temporary folder, open PowerShell with administrator privileges, navigate to the temporary folder, and run .\UpdateAllUsers-QA. In normal cases, the script will show the message "Disabling Security Questions" and return to the prompt. Now, if your current security profile blocks the use of scripts in PowerShell, you'll need to modify that first, or you'll get several error messages. There can also be access conflicts with some Registry strings. If that happens, you must manually go to the indicated paths and change the permissions.
As I said above, it's not that simple. Personally, I'd like the researchers to share a more polished tool, but at the same time we're dealing with a function tied to the operating system's security, and it deserves some respect from us. Proceed with caution.
https://old.neoteo.com/como-activar-el-modo-dios-en-windows-10/
