Recommendations for repurposing an old laptop as a Plex Media Server

[kapad]

Hi,

I have an old Surface Pro 6 that I want to repurpose as a Plex Media Server host. In future, I may host other services on this laptop and also may want to open some ports on my router to access services running on the machine.

Regardless of whether or not this is a good idea, what's the most secure way to set things up?

For now, I have the following in place,

• Wiped my laptop
• Re-installed windows (Windows 11 Pro) from a recovery image I had created prior to wiping. (I was careful to deselect the option to include personal data in the recovery image).
• Ran the Harden Windows Security script with the Recommended preset.
• The Verify tab shows that I still have 21 non-compliant items. I have the script logs and can share these.

What I want my setup to look like,

• I want to be able to freely share the device with others, but only to browse the web and/or access the media content stored on the device.
• Plex Media Server and other services should run as a different user. Ideally a different user for each service.
• I have created a Microsoft Account which will be dedicated to use as the Admin logon for this device.

What should I be doing next to continue with this setup?

• How can I create a user for Plex Media Server and then run the server as this user?
• How can I fix the 21 non-compliant items that I see?
• Can I share the script logs here? Other than my name, is there any private info in those logs that I should look to obfuscate?

Any additional tips and suggestions are welcome.

A bit of context: For work, I have setup and managed Linux based systems. This is my first crack at hosting services from a windows system.

[HotCakeX]

Hi,
Sorry but I'm not familiar with setting up Plex media server, never done it before.

How to fix the non-compliant items? please refer to the readme page, every single item for protection and compliance checking is mentioned there. Basically run the same category in the protection tab for the non-compliant item and it should make it compliant, that's all.

You can share the logs here but it's not necessary, the reason i made the Readme page very thorough and detailed is so that it is self-service and users will be able to find information they want on their own.

The version of the readme is also on my website here, it has search feature: https://hotcakex.github.io/

[kapad]

Hey, thanks for the info. I have gone through the README page, and to be honest, there's a lot of information to cover. And there's a lot of technical information in the linked documentation that I am not quite qualified to fully understand. I'm trying my best though.

Sorry but I'm not familiar with setting up Plex media server, never done it before.

Got it. But can you let me know in a generic sense, what are the options that I should be looking at to,

• Run a service as a separate user.
• Create multiple users, so that any services that I run on my machine can be configured to run as a different user. I user dedicated to each individual service/group of related services.

Also, do you have any additional tips/links/readmes on how to securely run an old windows laptop as a home server? That's kind of what I am looking to configure eventually. Plex media server is just my first priority right now.

[HotCakeX]

I can try improving the Readme page to be more consumable in terms of content and complexity

If the services don't need Admin privileges then running them as standard user can help. If you're planning to use your daily system for the media server and it's going to be exposed to the Internet, i would move it to a Hyper-V virtual machine instead to properly isolated it from the host and also deploy Application Control policies on the VM.

Using old laptop for home server could also work if you deploy App Control policy on it and use it only for media server (not daily usage).

Also connecting the media server laptop to a separate Internet connection, instead of your home network, can further isolate it, that is only if you expose it to the Internet.

If it's a local home server then you don't need to do any of that, you can disconnect Internet connectivity and use only the local WIFI/home network created by your router.

[kapad]

If you're planning to use your daily system for the media server

Nope. This is an older system that I've stopped using as my daily driver. That being said, using Hyper-V to host a service that's being publicly exposed to the internet makes sense (from a security perspective) regardless of whether or not it's my daily driver. Thanks for that suggestion. It's just that I don't know how to use Hyper-V, and it's something that I want to look into later.

App Control

I don't know much about App Control, and I found the Microsoft Learn pages on the subject quite dense. But I do plan to look into this too.

My biggest concern with this is the Firewall settings. On UNIX systems, I find the firewall concept a lot easier to understand. But when I look at the Windows firewall, I see a lot of rules in the inbound connections, and that concerns me. Why are there so many rules allowing different kinds of inbound connections?

[HotCakeX]

Firewall in Windows is a standard implementation, meaning it has the same concept as other firewalls, it's a stateful firewall that knows the difference between inbound/outbound TCP/UDP connections. So if you know the concepts of firewall in other OSes, you should be able to configure Windows Firewall too via GUI or command lines to meet your needs.

I have a wiki page about Hyper-V here, might be useful: https://github.com/HotCakeX/Harden-Windows-Security/wiki/Hyper-V
It's included by default in Windows so just have to turn it on from optional features section in control panel.

App Control is one of the best security features in Windows, it allows you to control exactly which files/apps are allowed to run on your system while everything else that is not allowed will be automatically blocked.

I've created an app to simplify its management: https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager

Lots of documentations exist in Microsoft Learn and here in this repository, more on the way: #487

[kapad]

Okay. At this point I think I may be guilty of too many follow ups. And thanks for responding each time.

Yes. I get the basics for the windows firewall implementation, and the rules around TCP and UDP connections.

When it comes to the windows firewall, there's a lot of rules already enabled, with the following groups.

• @{microsoftwindowscommunicationsapps_xxxxx......
• Core Networking
  With sub-groups
  • Destination Unreachable
  • DHCP In
  • IGMP
  • IPHTTPS
  • A weird rule that allows TCP traffic over IPv6 (for the System program)
  • Multicast listener (limited to the local subnet)
  • And a bunch of other rules
• Some rules for "Delivery optimization"
• Cast to device, which I don't think I will need if I am using this as a home server

I've uploaded the rules that are enabled on my device as a CSV (this list is filtered for Public and All profiles, and limited to the inbound rules that are enabled by default). [gist]

Now, when it comes to hardening network security, it's good to limit incoming connections to only those that are explicitly needed. What I need for now, is for incoming connections to Plex media server.

The thing is, I am not able to figure out which of the default rules I can safely disable without breaking my system. But I do want to try and harden the network as well. (I also want to avoid a trial and error approach).

When I first read through the docs for this project, I was hoping there would also be some network hardening. I noticed that the script does make all network connections (existing and new) to Public by default. I think this is a really good default to have. There's also other features in the script for network hardening, like disabling NetBIOS, printing, etc.

So, with regards to network hardening, do all the firewall rules that are enabled need to be enabled? I'm in situation where I have enough knowledge to ask the question, but not enough to answer it. It's possible that a lot of the inbound rules can be removed without affecting the functionality of the system (at least, for my purposes, and, maybe even a larger user group).